What is Zeus (Zbot) Malware?

Zeus (Zbot) Malware

malware OpenTrojan Threat Intelligence Updated 2026-08-26

Banking credentials; foundational formgrabber botnet

Source Attribution

Origin: MITRE
Source: FBI · FinCEN advisories
Reviewer: Phase 44E review
Verified: 2026-08-26T15:16:26.825Z
Confidence: high

Source: FBI · FinCEN advisories · Verified: 2026-08-26T15:16:26.825Z · Confidence: high

Security Timeline

2007-01 discovered Zeus first observed
2014-06 updated GameOver Zeus disrupted

Quick Answer

Zeus uses web-injection and form-grabbing on banking sessions, later versions (Zeus GameOver) added P2P botnet command and control.

Definition

Zeus/Zbot is the archetypal banking trojan family that pioneered man-in-the-browser credential theft and spawned many successors (GameOver Zeus).

Overview

Zeus/Zbot is the archetypal banking trojan family that pioneered man-in-the-browser credential theft and spawned many successors (GameOver Zeus).

Behavior

Man-in-the-browser credential theft
GameOver Zeus P2P botnet
Source code leaked 2011

First Seen

2007-01

Target

Banking credentials; foundational formgrabber botnet

Techniques: T1185, T1076, T1482
Campaigns: n/a
Related CVEs: n/a

Malware Intelligence

Family: Zeus (Zbot) Malware

Aliases: Zeus, Zbot

Techniques: T1185, T1076, T1482

Targets: Banking credentials; foundational formgrabber botnet

Behavior:

Man-in-the-browser credential theft
GameOver Zeus P2P botnet
Source code leaked 2011

References

Have a follow-up question?

Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.

Ask AI about this Start an investigation

Start Investigation

Move from reading to investigating Zeus (Zbot) Malware. The workspace is a structured analysis surface — not a chat — organised as:

Question — what do you need to know about Zeus (Zbot) Malware?

Evidence — assertions mapped to verifiable references.

Timeline — events in chronological order.

Related Entities — CVE, threat actor, campaign, malware links.

Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.

Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.