URSNIF_BankingTrojan - description

Sources:

Tax-themed spam campaign targeting North American taxpayers with URSNIF malware

URSNIF distribution through hijacked email reply chains

URSNIF is a banking trojan that primarily targets American taxpayers.

Attackers distribute this malware through phishing emails containing URLs that download zip archives with Visual Basic scripts. These scripts then download executable files. Once installed, URSNIF injects malicious code into websites the victim visits and steals user credentials.

Flowmon ADS detects download sites and communication with command and control servers.