Which malware remains dormant until the user performs an online financial transaction and edits registry entries at startup?

Which malware remains dormant until the user performs an online financial transaction and edits registry entries at startup?

• A. Form Grabber
• B. GlitchPOS
• C. Dreambot Trojans
• D. POS Trojans

Answer: (A)

This item is about how form grabbing malware operates. Form grabbing is designed to lie dormant on a system and only activates when you engage in an online financial transaction, intercepting data as you submit banking forms. It often achieves persistence by editing startup registry entries so it loads with Windows and stays resident across reboots. When you initiate a financial transaction, the malware hooks into the browser or intercepts the form submission to capture the data you enter, such as credentials or card details, before it’s sent to the bank. That combination of activation timing during online banking and startup persistence through registry edits is what characterizes this type of threat. The other options describe different attack vectors: POS Trojans target card data at point-of-sale terminals, GlitchPOS is a POS-focused family, and Dreambot Trojans are banking trojans that may use web injects and credential theft but aren’t defined by hiding until a financial transaction with startup registry persistence in the same way form grabbers are.

This item is about how form grabbing malware operates. Form grabbing is designed to lie dormant on a system and only activates when you engage in an online financial transaction, intercepting data as you submit banking forms. It often achieves persistence by editing startup registry entries so it loads with Windows and stays resident across reboots. When you initiate a financial transaction, the malware hooks into the browser or intercepts the form submission to capture the data you enter, such as credentials or card details, before it’s sent to the bank. That combination of activation timing during online banking and startup persistence through registry edits is what characterizes this type of threat.

The other options describe different attack vectors: POS Trojans target card data at point-of-sale terminals, GlitchPOS is a POS-focused family, and Dreambot Trojans are banking trojans that may use web injects and credential theft but aren’t defined by hiding until a financial transaction with startup registry persistence in the same way form grabbers are.