SOCA and Virgin partner in SpyEye fight
The troublesome SpyEye Trojan is being tackled head on by the Government body and the ISP.


The Serious Organised Crime Agency (SOCA) has joined forces with Virgin Media to help stop the spread of the dangerous SpyEye Trojan.
As part of the campaign, SOCA has identified around 1,500 Virgin Media customers infected with the SpyEye Trojan, which could place them at risk of identity theft or bank fraud.
Virgin has written to affected customers, offering them advice on how to remove the Trojan and help if they feel unable to take care of SpyEye themselves.
"SOCA works with a range of private sector partners to help prevent cyber criminals from exploiting legitimate businesses and their customers," said Lee Miles, SOCA head of cyber.
"We welcome steps taken within industry to utilise the information and resources provided by law enforcement and raise awareness of online safety."
SpyEye in the sky
Trusteer today revealed it had uncovered a SpyEye variant which targeted two leading European airline travel websites Air Berlin and Airplus.
Get the ITPro daily newsletter
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
The former is the second biggest airline in Germany, the latter a business travel service.
"In the case of the Air Berlin attack, SpyEye is attempting to harvest confidential user information including username and password, and other data that is entered in the targeted web page," said Amit Klein, chief technology officer of Trusteer, in a blog post.
"The injection code of SpyEye captures the information on username and password details."
In the AirPlus case, SpyEye targets users of the Lufthansa Miles & More Visa credit card, which offers travel bonuses.
"In this instance, SpyEye injects code into the users' web browser that claims to be an anti-fraud enhancement to the online," Klein added.
"In reality, of course, this is a cleverly-disguised attempt to phish user credentials from the unsuspecting customer of the AirPlus Web portal."
Tom Brewster is currently an associate editor at Forbes and an award-winning journalist who covers cyber security, surveillance, and privacy. Starting his career at ITPro as a staff writer and working up to a senior staff writer role, Tom has been covering the tech industry for more than ten years and is considered one of the leading journalists in his specialism.
He is a proud alum of the University of Sheffield where he secured an undergraduate degree in English Literature before undertaking a certification from General Assembly in web development.
-
M&S suspends online sales as 'cyber incident' continues
News Marks & Spencer (M&S) has informed customers that all online and app sales have been suspended as the high street retailer battles a ‘cyber incident’.
By Ross Kelly
-
Manners cost nothing, unless you’re using ChatGPT
Opinion Polite users are costing OpenAI millions of dollars each year – but Ps and Qs are a small dent in what ChatGPT could cost the planet
By Ross Kelly
-
CronRat Magecart malware uses 31st February date to remain undetected
News The malware allows for server-side payment skimming that bypasses browser security
By Rene Millman
-
Mekotio trojan continues to spread despite its operators’ arrests
News Hackers have used it in 100 more attacks since arrests
By Rene Millman
-
“Trojan Source” hides flaws in source code from humans
News Organizations urged to take action to combat the new threat that could result in SolarWinds-style attacks
By Rene Millman
-
What is Emotet?
In-depth A deep dive into one of the most infamous and prolific strains of malware
By Praharsha Anand
-
Fake AnyDesk Google ads deliver malware
News Malware pushed through Google search results
By Rene Millman
-
Hackers use open source Microsoft dev platform to deliver trojans
News Microsoft's Build Engine is being used to deploy Remcos password-stealing malware
By Rene Millman
-
Android users told to be on high alert after Cerberus banking Trojan leaks to the dark web
News The source code for the authenticator-breaking malware is available for free on underground forums
By Sabina Weston
-
Qbot malware surges into the top-ten most common business threats
News An evolved form of the banking Trojan was distributed by number one-ranking Emotet in a campaign that hit 5% of businesses globally
By Keumars Afifi-Sabet