High rolling cyber-crooks are smashing bank security safeguards

The pair say that they have observed a crime ring building on the established Zeus and SpyEye malware to develop attacks against at least 60 financial institutions in Europe, the US and Latin America.

Most Zeus/SpyEye attacks rely on manual components and active participation by the fraudster, using social engineering to compromise computers before planting malware and executing a Man-in-the-Browser attack to skim details that let them carry out transfers.

In contrast, although there can be live intervention in the most high-value transactions, most of the new 'High Roller' process is completely automated, allowing repeated thefts once the system has been launched at a given financial institution or for a given Internet banking platform.

In March crooks used server-side automated attacks to compromise more than 5000 - mainly business - accounts at two Dutch banks, attempting to wire around EUR35.6 million out of the country in transfers of up to EUE100,000 a time.

All of the attacks spotted by McAfee could bypass complex multi-stage authentication and chip and PIN. Unlike recent attacks that collect simple form authentication data - a security challenge question, a one-time token, or PIN - this can get past the extensive physical authentication required by swiping a card in a reader and typing the input into a field.

Separately, Jonathan Evans, director general of the UK's domestic security service, MI5, has claimed in a speech that state-sponsored cyber-attacks cost a single listed UK company around £800 million in lost potential revenues.

Evans says that his organisation is fighting "astonishing" levels of cyber attacks on UK industry, warning that the Olympic Games will prove an "attractive target" for terrorists".

Read the McAfee-Guardian Analytics report here: