{"id":32739,"date":"2014-01-28T14:20:32","date_gmt":"2014-01-28T22:20:32","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=32739"},"modified":"2025-06-02T23:42:03","modified_gmt":"2025-06-03T06:42:03","slug":"neverquest-banking-trojan-wild","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/neverquest-banking-trojan-wild\/","title":{"rendered":"Neverquest Banking Trojan Uses VNC, SOCKS in New Threat"},"content":{"rendered":"<p style=\"text-align: justify;\">A new banking Trojan in the news, known as Neverquest, is active and being used to attack a number of popular banking websites. This Trojan can identify target sites by searching for specific keywords on web pages that victims are browsing. After infecting a system, the malware gives an attacker control of the infected machine with the help of a Virtual Network Computing (VNC, for remote access) and SOCKS proxy server. The Trojan targets several banking sites and steals sensitive information such as login credentials that customers enter into these websites. The Trojan also steals login information related to social networking sites (listed in the configuration file) like Twitter, and sends this information to its control server.<\/p>\n<p style=\"text-align: justify;\">Once it infects a system, the Trojan drops a random-name DLL (for example, cjekvxk.dat) with a .dat extension in the %APPDATA% folder. The Trojan then automatically runs this DLL using regsvr32.exe \/s [DLL PATH] by adding a key under \u201cSoftware\\Microsoft\\Windows\\CurrentVersion\\Run\\.\u201d The Trojan tries to inject its malicious code into running processes and waits for browser processes such as iexplorer.exe or firefox.exe. Once the victim opens any site with these browsers, the Trojan requests the encrypted configuration file from its control server, as we see in this screenshot:<\/p>\n<p style=\"text-align: justify;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquest_config_request.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-32792\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquest_config_request.png\" alt=\"neverquest_config_request\" width=\"760\" height=\"604\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/neverquest_config_request.png 760w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/neverquest_config_request-300x238.png 300w\" sizes=\"auto, (max-width: 760px) 100vw, 760px\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">The Trojan generates a unique ID number that will be used in subsequent requests. The reply is encrypted with <a href=\"https:\/\/ibsensoftware.com\/products_aPLib.html\">aPLib<\/a> compression. The reply data is appended to an &#8220;AP32\u201d string, followed by a decompression routine, as shown:<\/p>\n<p style=\"text-align: justify;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquest_config_decode.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-32793\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquest_config_decode.png\" alt=\"neverquest_config_decode\" width=\"692\" height=\"767\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/neverquest_config_decode.png 692w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/neverquest_config_decode-270x300.png 270w\" sizes=\"auto, (max-width: 692px) 100vw, 692px\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">The configuration file contains a huge amount of JavaScript code, a number of bank websites, social networking websites, and list of financial keywords. The JavaScript code in the configuration file used to modify the page contents of the bank&#8217;s site to steal sensitive information. Let&#8217;s look at the configuration file:<\/p>\n<p style=\"text-align: justify;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquest_config_code1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-32743\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquest_config_code1.png\" alt=\"neverquest_config_code\" width=\"1399\" height=\"703\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/neverquest_config_code1.png 1399w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/neverquest_config_code1-300x150.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/neverquest_config_code1-1024x514.png 1024w\" sizes=\"auto, (max-width: 1399px) 100vw, 1399px\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">The Trojan targets financial institutions including Bank of America, CitiBank, and many others. Here is a list of target sites found in the decrypted configuration file:<\/p>\n<p style=\"text-align: justify;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquerst_bank_list.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-32744\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquerst_bank_list.png\" alt=\"neverquerst_bank_list\" width=\"664\" height=\"425\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/neverquerst_bank_list.png 664w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/neverquerst_bank_list-300x192.png 300w\" sizes=\"auto, (max-width: 664px) 100vw, 664px\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">The Trojan asks for sensitive information by modifying the page contents that a victim visits. The configuration file also contains a list of social networking sites and a list of keywords related to banking:<\/p>\n<p style=\"text-align: justify;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquest_keywords.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-32795\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquest_keywords.png\" alt=\"neverquest_keywords\" width=\"1200\" height=\"345\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/neverquest_keywords.png 1200w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/neverquest_keywords-300x86.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/neverquest_keywords-1024x294.png 1024w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">If the Trojan finds any of the keywords on a web page, it will steal the full URL and all user-entered information and sends this data to the attacker:<\/p>\n<p style=\"text-align: justify;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquest_steal_pass.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-32747\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquest_steal_pass.png\" alt=\"neverquest_steal_pass\" width=\"1037\" height=\"707\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/neverquest_steal_pass.png 1037w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/neverquest_steal_pass-300x204.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/neverquest_steal_pass-1024x698.png 1024w\" sizes=\"auto, (max-width: 1037px) 100vw, 1037px\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">The Trojan sends a unique ID number followed by the full URL containing username and password. (We&#8217;ve entered fake information to capture the logs.) The Trojan also sends all web page contents compressed with aPLib to the attacker in the following format:<\/p>\n<p style=\"text-align: justify;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquest_webpage_steal.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-32748\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquest_webpage_steal.png\" alt=\"neverquest_webpage_steal\" width=\"738\" height=\"492\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/neverquest_webpage_steal.png 738w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/neverquest_webpage_steal-300x200.png 300w\" sizes=\"auto, (max-width: 738px) 100vw, 738px\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">The Trojan steals information entered on social networking sites listed in the configuration file and can use that data to further spread the malicious code:<\/p>\n<p style=\"text-align: justify;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquest_twitter_pass.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-32749\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquest_twitter_pass.png\" alt=\"neverquest_twitter_pass\" width=\"716\" height=\"465\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/neverquest_twitter_pass.png 716w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/neverquest_twitter_pass-300x194.png 300w\" sizes=\"auto, (max-width: 716px) 100vw, 716px\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">The Trojan keeps on stealing new data and updating its configuration file. The attacker uses a SOCKS and VNC server to carry out malicious activities. Here is a snapshot of strings we found:<\/p>\n<p style=\"text-align: justify;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquest_vncsocks.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-32797\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquest_vncsocks.png\" alt=\"neverquest_vncsocks\" width=\"910\" height=\"819\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/neverquest_vncsocks.png 910w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/neverquest_vncsocks-300x270.png 300w\" sizes=\"auto, (max-width: 910px) 100vw, 910px\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">The Trojan can steal SMTP (Simple Mail Transfer Protocol) and POP (Post Office Protocol) credentials from email clients. It can also steal FTP login credentials from various programs that can be used to\u00a0distribute the malicious code:<\/p>\n<p style=\"text-align: justify;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquest_list_ftp.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-32799\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquest_list_ftp.png\" alt=\"neverquest_list_ftp\" width=\"979\" height=\"916\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/neverquest_list_ftp.png 979w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/neverquest_list_ftp-300x280.png 300w\" sizes=\"auto, (max-width: 979px) 100vw, 979px\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">We have also found an updated configuration file that contains code to request additional JavaScript files targeting financial sites such as BMO (Bank of Montreal), PayPal, RBC (Royal Bank of Canada), and others from a different malicious server. The malicious server has several web panels for collecting sensitive information from different financial sites&#8211;which shows attackers are learning and creating new fake pages for new sites. The JavaScript code:<\/p>\n<p style=\"text-align: justify;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquest_rbc_webpanel.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-32777\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquest_rbc_webpanel.png\" alt=\"neverquest_rbc_webpanel\" width=\"1023\" height=\"570\" \/><\/a><\/p>\n<h2>The Alarming Dangers of Banking Trojans<\/h2>\n<p style=\"text-align: justify;\">The preceding JavaScript code is displayed in the victims&#8217; browsers if they visit these sites. There are many banking Trojans, but Neverquest has more capabilities than most. Attackers can hide their tracks with the help of proxy and remote control and can carry out transactions from the infected machines. The Trojan can search for new banking sites with the help of financial keywords listed in the configuration file. The Trojan can also steal new banking URLs and their page contents, which eventually update its configuration file. In this way Neverquest can grow its target database to carry out future attacks.<\/p>\n<p style=\"text-align: justify;\"><em>I would like to thank my colleague Vikas Taneja for assistance with this research.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A new banking Trojan in the news, known as Neverquest, is active and being used to attack a number of&#8230;<\/p>\n","protected":false},"author":674,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[1814,32,142,180,321],"coauthors":[3973],"class_list":["post-32739","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-computer-security","tag-data-protection","tag-tag-identity-theft","tag-malware","tag-social-networking"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Neverquest Banking Trojan Uses VNC, SOCKS in New Threat | McAfee Blog<\/title>\n<meta name=\"description\" content=\"A new banking Trojan in the news, known as Neverquest, is active and being used to attack a number of popular banking websites. This Trojan can identify\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Neverquest Banking Trojan Uses VNC, SOCKS in New Threat | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"A new banking Trojan in the news, known as Neverquest, is active and being used to attack a number of popular banking websites. This Trojan can identify\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/neverquest-banking-trojan-wild\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2014-01-28T22:20:32+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-03T06:42:03+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/neverquest_config_request.png\" \/>\n\t<meta property=\"og:image:width\" content=\"760\" \/>\n\t<meta property=\"og:image:height\" content=\"604\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"McAfee\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"McAfee\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/neverquest-banking-trojan-wild\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/neverquest-banking-trojan-wild\/\"},\"author\":{\"name\":\"McAfee\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa\"},\"headline\":\"Neverquest Banking Trojan Uses VNC, SOCKS in New Threat\",\"datePublished\":\"2014-01-28T22:20:32+00:00\",\"dateModified\":\"2025-06-03T06:42:03+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/neverquest-banking-trojan-wild\/\"},\"wordCount\":725,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/neverquest-banking-trojan-wild\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquest_config_request.png\",\"keywords\":[\"computer security\",\"data protection\",\"identity theft\",\"malware\",\"social networking\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/neverquest-banking-trojan-wild\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/neverquest-banking-trojan-wild\/\",\"name\":\"Neverquest Banking Trojan Uses VNC, SOCKS in New Threat | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/neverquest-banking-trojan-wild\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/neverquest-banking-trojan-wild\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquest_config_request.png\",\"datePublished\":\"2014-01-28T22:20:32+00:00\",\"dateModified\":\"2025-06-03T06:42:03+00:00\",\"description\":\"A new banking Trojan in the news, known as Neverquest, is active and being used to attack a number of popular banking websites. This Trojan can identify\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/neverquest-banking-trojan-wild\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/neverquest-banking-trojan-wild\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/neverquest-banking-trojan-wild\/#primaryimage\",\"url\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquest_config_request.png\",\"contentUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquest_config_request.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/neverquest-banking-trojan-wild\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Neverquest Banking Trojan Uses VNC, SOCKS in New Threat\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa\",\"name\":\"McAfee\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/1ffadfeeda1f4f9e7891a81f27a9ecf4\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png\",\"caption\":\"McAfee\"},\"description\":\"We're here to make life online safe and enjoyable for everyone.\",\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/x.com\/McAfee\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/mcafee\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Neverquest Banking Trojan Uses VNC, SOCKS in New Threat | McAfee Blog","description":"A new banking Trojan in the news, known as Neverquest, is active and being used to attack a number of popular banking websites. This Trojan can identify","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Neverquest Banking Trojan Uses VNC, SOCKS in New Threat | McAfee Blog","og_description":"A new banking Trojan in the news, known as Neverquest, is active and being used to attack a number of popular banking websites. This Trojan can identify","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/neverquest-banking-trojan-wild\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_author":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2014-01-28T22:20:32+00:00","article_modified_time":"2025-06-03T06:42:03+00:00","og_image":[{"width":760,"height":604,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/neverquest_config_request.png","type":"image\/png"}],"author":"McAfee","twitter_card":"summary_large_image","twitter_creator":"@McAfee","twitter_site":"@McAfee","twitter_misc":{"Written by":"McAfee","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/neverquest-banking-trojan-wild\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/neverquest-banking-trojan-wild\/"},"author":{"name":"McAfee","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa"},"headline":"Neverquest Banking Trojan Uses VNC, SOCKS in New Threat","datePublished":"2014-01-28T22:20:32+00:00","dateModified":"2025-06-03T06:42:03+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/neverquest-banking-trojan-wild\/"},"wordCount":725,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/neverquest-banking-trojan-wild\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquest_config_request.png","keywords":["computer security","data protection","identity theft","malware","social networking"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/neverquest-banking-trojan-wild\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/neverquest-banking-trojan-wild\/","name":"Neverquest Banking Trojan Uses VNC, SOCKS in New Threat | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/neverquest-banking-trojan-wild\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/neverquest-banking-trojan-wild\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquest_config_request.png","datePublished":"2014-01-28T22:20:32+00:00","dateModified":"2025-06-03T06:42:03+00:00","description":"A new banking Trojan in the news, known as Neverquest, is active and being used to attack a number of popular banking websites. This Trojan can identify","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/neverquest-banking-trojan-wild\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/neverquest-banking-trojan-wild\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/neverquest-banking-trojan-wild\/#primaryimage","url":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquest_config_request.png","contentUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/neverquest_config_request.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/neverquest-banking-trojan-wild\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Neverquest Banking Trojan Uses VNC, SOCKS in New Threat"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa","name":"McAfee","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/1ffadfeeda1f4f9e7891a81f27a9ecf4","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png","caption":"McAfee"},"description":"We're here to make life online safe and enjoyable for everyone.","sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/x.com\/McAfee"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/mcafee\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/32739","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/674"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=32739"}],"version-history":[{"count":2,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/32739\/revisions"}],"predecessor-version":[{"id":214996,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/32739\/revisions\/214996"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=32739"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=32739"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=32739"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=32739"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}