A new security advisory was issued by online businesses customer protection company Trusteer regarding a new Trojan virus that threatens US online financial services users, Reuters reports.

Dubbed W32.Silon, the Trojan bypasses security tokens, banking card readers and uses a two pronged payload to steal login information and commit online financial fraud. According to Trusteer, the company’s Rapport browser plug-in plus security service has blocked attempts made by the W32.Silon Trojan to compromise consumer internet banking accounts.

W32.Silon is a new malware variant that intercepts Internet Explorer web browser sessions, and has been associated with fraud incidents at several large banks. Trusteer retrieved and analyzed a sample of this two headed Trojan, which is designed to steal generic login information and commit bank-specific fraud. To steal user credentials, W32.Silon performs its initial attack when a user initiates a web login session and enters their username and password. The malware intercepts the login POST request, encrypts the requested data, and forwards it to a command and control (C&C) server.

When it targets users of online banking applications that are protected by transaction authentication devices such as tokens or banking card readers, W32.Silon waits until the user has logged on and then injects dynamic HTML code into the login flow between the user and the bank’s web server.