Threat taxonomy
high activityFinancial MalwareFirst seen 2025
Zemen Inject
Aliases: ZMN web-inject kit
A browser web-inject kit sold with templates for African retail banking portals, capable of real-time session interception and one-time-code relay.
Attribution
Commodity kit with regional templates
Primary targets
- — Retail banking customers
- — Fintech wallet users
Observed tactics
- Malvertising and search-poisoning delivery
- Real-time OTP relay to operator panel
- Beneficiary substitution at transaction confirmation
Regional relevance
Templates matching Ethiopian and Kenyan retail portals are actively maintained, indicating sustained operator demand.
Detection guidance
- Fingerprint browser environments for injected DOM markers
- Alert on beneficiary change plus immediate high-value transfer
- Monitor for session anomalies during OTP entry
Related feed reporting
- critical14 Sept 2026
Credential-harvesting kit impersonates Ethiopian national payment switch
- medium03 Sept 2026
ATM switch manipulation attempt blocked at an East African bank
- high27 Aug 2026
Infostealer logs containing banking VPN credentials sold in bulk