Skip to content
Syn_OS Phoenix Syn_OS

Form Grabber

Risk Level

Introduction

Section titled “Introduction”

A form grabber hooks browser APIs to capture form data (credentials, credit cards, PII) before TLS encryption, bypassing HTTPS protection. It’s a core component of banking trojans and info stealers.

How It Works

Section titled “How It Works”
Hook TargetBrowserCaptures
PR_Read / PR_WriteFirefox (NSPR)Plaintext form data
SSL_Read / SSL_WriteFirefox (NSS)Pre-TLS plaintext
InternetReadFile / InternetWriteFileIE/Edge (WinINet)WinINet traffic
WinHttpReadData / WinHttpWriteDataWinHTTPWinHTTP traffic
Chrome APIChromeCustom hooks via extension/injection

Attack Flow

Section titled “Attack Flow”
1. INJECTION
   └─ DLL injection into browser process
   └─ Or malicious browser extension


2. API HOOKING
   └─ Detour / IAT hook / inline hook target APIs
   └─ Intercept plaintext before TLS encryption


3. DATA CAPTURE
   └─ Parse HTTP POST bodies for form fields
   └─ Extract: username, password, CC, SSN, etc.


4. EXFILTRATION
   └─ Send to C2 via HTTP/HTTPS/DNS
   └─ Often real-time (before user submits)

Notable Families

Section titled “Notable Families”
FamilyTypeNotable
Zeus/ZbotForm grabber + kernelFirst major
SpyEyeForm grabberForm grab focus
CitadelZeus forkModular
TinbaTiny Banking Trojan20KB; form grab
DridexMacro deliveryForm grab + webinject
TrickBotModularForm grab module
Tiny Banker / TinbaMinimal20KB

Detection

Section titled “Detection”
IndicatorDetection
API HooksEDR hook detection (IAT, inline, EAT)
Browser Process InjectionEDR process tree
NetworkC2 communication patterns
MemoryInjected DLL in browser process

Prevention

Section titled “Prevention”
  • ✅ FIDO2/WebAuthn — No passwords to steal
  • ✅ Password Manager — Auto-fill bypasses form fields
  • ✅ EDR with API Hook Detection — Monitor IAT/EAT/inline hooks
  • ✅ Browser Hardening — Disable unnecessary extensions
  • ✅ Memory Scanning — Detect injected code in browser
  • ✅ Virtual Keyboard — For high-value entry

MITRE ATT&CK

Section titled “MITRE ATT&CK”
TechniqueIDDescription
Input CaptureT1056Form grabbing
Credentials from Password StoresT1555Browser password theft
Web Session CookieT1550.004Session hijacking
Section titled “Related”