New Banking Trojan "Ice IX" Redirects Bank Phone Calls to Attackers

CyberCriminals have developed a new banking Trojan named as Ice IX that is capable of redirecting calls .  Ice IX is new variant of notorious Zeus malware ,targets Banking customers in the UK and US.

In addition to stealing bank account data from infected machines, these Ice IX configurations are capturing information on telephone accounts belonging to the victims .   

By gaining the control to the phone calls, hacker can divert calls from the bank intended for their customer to hacker controlled phone numbers.

Trusteer security researchers analyzed the malware and discovered it steals the victim's user ID and pasword , memorable  information/secret question answer, date of birth and account balance from a compromised system.

As part of the attack, the victim will be asked to update their phone numbers of record (home, mobile and work) and select the name of their service provider from a drop-down list. In this particular attack, the three most popular phone service providers in the UK are presented: British Telecommunications, TalkTalk and Sky.


To take control of the victims phone line, the victim will be asked by malware to  submit their telephone account number. This is very private data typically only known to the phone subscriber and the phone company. It is used by the phone company to verify the identity of the subscriber and authorize sensitive account modifications such as call forwarding. The fraudsters justify this request by stating this information is required as a part of verification process caused by "a malfunction of the bank’s anti-fraud system with its landline phone service provider".

The full detail about malware attack with screenshot is explained in Trusteer.