Netskope Threat Labs

Zbot

ATP Sandbox Adv. HeuristicsAV

Zbot (a.k.a. Zeus) is a banking trojan that steals credentials and financial information from infected systems through form grabbing, keylogging, and web injects. Its builder turned it into a platform that criminal crews customized for credential theft and fraud, and its leaked source code seeded countless descendant families. Although the original operation faded, its DNA runs through much of modern banking malware, and its name remains a reference point for credential theft.

First seen
January 2022
Last seen
October 2026
ZBot
Alert Name
Backdoor.Zbot.D
Backdoor.Zbot.G
Backdoor.Zbot.O
ByteCode-MSIL.Infostealer.Zbot
Gen:Variant.VB.Zbot.1
Gen:Variant.Zbot.10
Gen:Variant.Zbot.106
Gen:Variant.Zbot.1194
Gen:Variant.Zbot.122
Gen:Variant.Zbot.1224