Netskope Threat Labs

SpyEye

ATP Sandbox Adv. HeuristicsAV

SpyEye is a banking trojan that targets browsers on Windows and Safari on iOS, originating in Russia and sold on underground forums for over 500 dollars as a claimed successor to Zeus. Its features included keylogging, automatic credit card form filling, email backups, and FTP and POP3 grabbers, and it could steal money from online bank accounts and initiate transactions while valid users remained logged in.

First seen
April 2022
Last seen
September 2026
Alert Name
ByteCode-MSIL.Trojan.SpyEye
Trojan.SpyEye.S
Win32.Trojan.SpyEye