{"id":34924,"date":"2020-05-11T15:15:55","date_gmt":"2020-05-11T15:15:55","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/31197\/Zeus-Sphinx-Revamped-As-Coronavirus-Scams-Continue.html"},"modified":"2020-05-11T15:15:55","modified_gmt":"2020-05-11T15:15:55","slug":"zeus-sphinx-revamped-as-coronavirus-scams-continue","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/zeus-sphinx-revamped-as-coronavirus-scams-continue\/","title":{"rendered":"Zeus Sphinx Revamped As Coronavirus Scams Continue"},"content":{"rendered":"<div><img decoding=\"async\" src=\"https:\/\/zdnet1.cbsistatic.com\/hub\/i\/r\/2020\/05\/11\/f664ec44-573d-4852-8dd8-40ea93f89bea\/thumbnail\/770x578\/c0fe2babfed6bea951e0207dd7d4c4b4\/screenshot-2020-05-11-at-11-55-38.png\" class=\"ff-og-image-inserted\"><\/div>\n<p>The Zeus Sphinx banking Trojan is now receiving frequent updates and upgrades to its malicious arsenal while being deployed in active <span class=\"link\"><a href=\"https:\/\/www.cnet.com\/how-to\/coronavirus-and-covid-19-all-your-questions-answered\/\" data-omniture-track=\"moduleClick\" data-omniture-track-data=\"{&quot;moduleInfo&quot;: &quot;link_anchor&quot;, &quot;pageType&quot;: &quot;article&quot;}\" rel=\"noopener noreferrer\" target=\"_blank\" data-component=\"externalLink\">coronavirus<\/a><\/span> scams.&nbsp;<\/p>\n<p>On Monday, IBM Security researcher Nir Shwarts said the company has been tracking the evolution of the malware which is based on the leaked codebase of the well-known Zeus v.2 Trojan.<\/p>\n<p>Zeus Sphinx &#8212; also referred to as Zloader or Terdot &#8212; first emerged in 2015 and was used in attacks launched against US banks. However, the malware vanished from the criminal scene and, with the exception of a handful of campaigns over the years, lay dormant until now, when it has once again been spotted in attacks against banks &#8212; as well as a new campaign related to COVID-19.<\/p>\n<p>In March, IBM documented <a href=\"https:\/\/www.zdnet.com\/article\/zeus-sphinx-malware-resurrects-to-abuse-covid-19-fears-and-steal-banking-data\/\" target=\"_blank\" rel=\"noopener noreferrer\">a wave of attacks<\/a> in which the Trojan has been hidden in phishing documents, spread via email and masked as information relating to COVID-19 relief payments.&nbsp;<\/p>\n<p><strong>See also:&nbsp;<\/strong><a href=\"https:\/\/www.zdnet.com\/article\/zeus-sphinx-malware-resurrects-to-abuse-covid-19-fears-and-steal-banking-data\/\" target=\"_blank\" rel=\"noopener noreferrer\">Zeus Sphinx malware resurrects to abuse COVID-19 fears<\/a><\/p>\n<p>These attacks remain active and attempt to capitalize on fears surrounding the financial ramifications of the virus, at a time where many have lost their means of support and are relying on assistance.&nbsp;<\/p>\n<p><a href=\"https:\/\/securityintelligence.com\/posts\/zeus-sphinx-back-in-business-some-core-modifications-arise\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">According to IBM<\/a>, the malware is now becoming more firmly entrenched by way of constant upgrades to improve its potency.&nbsp;<\/p>\n<section class=\"sharethrough-top\" data-component=\"medusaContentRecommendation\" data-medusa-content-recommendation-options=\"{&quot;promo&quot;:&quot;promo_zd_recommendation_sharethrough_top_in_article_desktop&quot;,&quot;spot&quot;:&quot;dfp-in-article&quot;}\">\n<\/section>\n<p>Zeus Sphinx first lands on machines through a malicious attachment in which victims are asked to enable macros. Once deployed, the malware adds a Run key to the Windows Registry &#8212; a very common method to maintain persistence that has also been used by Zeus Sphinx since it first appeared &#8212; and will either deploy as an executable or as a malicious dynamic link library (DLL).&nbsp;<\/p>\n<p>The malware has been designed to grab credentials, such as banking details or account usernames and passwords for online services. Zeus Sphinx uses browser injection techniques to achieve this goal, inserting malicious code into explorer.exe and browser processes to redirect victims to fraudulent domains when they attempt to visit financial websites.&nbsp;<\/p>\n<p>Zeus Sphinx will also create a standalone process, named msiexec.exe to mimic a legitimate program, in an attempt to remain stealthy. &nbsp;<\/p>\n<p><strong>CNET:&nbsp;<\/strong><a href=\"https:\/\/www.cnet.com\/news\/zoom-security-issues-zoom-buys-security-company-aims-for-end-to-end-encryption\/?ftag=CMG-01-10aaa1b\" target=\"_blank\" rel=\"noopener noreferrer\" data-component=\"externalLink\">Zoom security issues: Zoom buys security company, aims for end-to-end encryption<\/a><\/p>\n<p>In January 2020, malware samples &#8212; including a variant ID in Russian named &#8220;2020 Upgrade,&#8221; used a varied command-and-control (C2) server domain list and an RC4 key for botnet communication encryption purposes.&nbsp;<\/p>\n<p>New variants of the malware, however, have expanded to include a different set of RC4 keys, a smaller and different set of C2s, and a new variant ID.<\/p>\n<p>Sphinx also uses a pseudo-random number generator (PRNG) named MT19937 to create a variance in file names and resources for each infected device to try and avoid detection by static scanning tools.&nbsp;<\/p>\n<p><strong>TechRepublic:&nbsp;<\/strong><a href=\"https:\/\/www.techrepublic.com\/article\/5-things-developers-should-know-about-data-privacy-and-security\/?ftag=CMG-01-10aaa1b\" target=\"_blank\" rel=\"noopener noreferrer\" data-component=\"externalLink\">5 things developers should know about data privacy and security<\/a><\/p>\n<p>&#8220;While less common in the wild than Trojans like TrickBot, for example, Sphinx&#8217;s underlying Zeus DNA has been an undying enabler of online banking fraud,&#8221; IBM says. &#8220;Financial institutions must reckon with its return and spread to new victims amid the current pandemic.&#8221;<\/p>\n<p>Trickbot, too, is being used in <a href=\"https:\/\/www.zdnet.com\/article\/trickbot-malware-is-using-these-unique-macro-laced-document-attachments-with-a-coronavirus-theme\/\" target=\"_blank\" rel=\"noopener noreferrer\">coronavirus-themed lures<\/a>. Microsoft&#8217;s Security Intelligence team said in April that phishing campaigns spreading the malware are using themes including COVID-19 testing and medical advice.&nbsp;<\/p>\n<h3>Previous and related coverage<\/h3>\n<hr>\n<p><strong>Have a tip?<\/strong> Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0<\/p>\n<hr>\n<p>READ MORE <a href=\"https:\/\/packetstormsecurity.com\/news\/view\/31197\/Zeus-Sphinx-Revamped-As-Coronavirus-Scams-Continue.html\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":34925,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[60],"tags":[3358],"class_list":["post-34924","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-packet-storm","tag-headlinemalwarecybercrimefraud"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Zeus Sphinx Revamped As Coronavirus Scams Continue 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/zeus-sphinx-revamped-as-coronavirus-scams-continue\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Zeus Sphinx Revamped As Coronavirus Scams Continue 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/zeus-sphinx-revamped-as-coronavirus-scams-continue\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2020-05-11T15:15:55+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/05\/zeus-sphinx-revamped-as-coronavirus-scams-continue.png\" \/>\n\t<meta property=\"og:image:width\" content=\"770\" \/>\n\t<meta property=\"og:image:height\" content=\"578\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/zeus-sphinx-revamped-as-coronavirus-scams-continue\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/zeus-sphinx-revamped-as-coronavirus-scams-continue\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Zeus Sphinx Revamped As Coronavirus Scams Continue\",\"datePublished\":\"2020-05-11T15:15:55+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/zeus-sphinx-revamped-as-coronavirus-scams-continue\\\/\"},\"wordCount\":586,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/zeus-sphinx-revamped-as-coronavirus-scams-continue\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/05\\\/zeus-sphinx-revamped-as-coronavirus-scams-continue.png\",\"keywords\":[\"headline,malware,cybercrime,fraud\"],\"articleSection\":[\"Packet Storm\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/zeus-sphinx-revamped-as-coronavirus-scams-continue\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/zeus-sphinx-revamped-as-coronavirus-scams-continue\\\/\",\"name\":\"Zeus Sphinx Revamped As Coronavirus Scams Continue 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/zeus-sphinx-revamped-as-coronavirus-scams-continue\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/zeus-sphinx-revamped-as-coronavirus-scams-continue\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/05\\\/zeus-sphinx-revamped-as-coronavirus-scams-continue.png\",\"datePublished\":\"2020-05-11T15:15:55+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/zeus-sphinx-revamped-as-coronavirus-scams-continue\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/zeus-sphinx-revamped-as-coronavirus-scams-continue\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/zeus-sphinx-revamped-as-coronavirus-scams-continue\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/05\\\/zeus-sphinx-revamped-as-coronavirus-scams-continue.png\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/05\\\/zeus-sphinx-revamped-as-coronavirus-scams-continue.png\",\"width\":770,\"height\":578},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/zeus-sphinx-revamped-as-coronavirus-scams-continue\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"headline,malware,cybercrime,fraud\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/tag\\\/headlinemalwarecybercrimefraud\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Zeus Sphinx Revamped As Coronavirus Scams Continue\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Zeus Sphinx Revamped As Coronavirus Scams Continue 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/zeus-sphinx-revamped-as-coronavirus-scams-continue\/","og_locale":"en_US","og_type":"article","og_title":"Zeus Sphinx Revamped As Coronavirus Scams Continue 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/zeus-sphinx-revamped-as-coronavirus-scams-continue\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2020-05-11T15:15:55+00:00","og_image":[{"width":770,"height":578,"url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/05\/zeus-sphinx-revamped-as-coronavirus-scams-continue.png","type":"image\/png"}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/zeus-sphinx-revamped-as-coronavirus-scams-continue\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/zeus-sphinx-revamped-as-coronavirus-scams-continue\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Zeus Sphinx Revamped As Coronavirus Scams Continue","datePublished":"2020-05-11T15:15:55+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/zeus-sphinx-revamped-as-coronavirus-scams-continue\/"},"wordCount":586,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/zeus-sphinx-revamped-as-coronavirus-scams-continue\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/05\/zeus-sphinx-revamped-as-coronavirus-scams-continue.png","keywords":["headline,malware,cybercrime,fraud"],"articleSection":["Packet Storm"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/zeus-sphinx-revamped-as-coronavirus-scams-continue\/","url":"https:\/\/www.threatshub.org\/blog\/zeus-sphinx-revamped-as-coronavirus-scams-continue\/","name":"Zeus Sphinx Revamped As Coronavirus Scams Continue 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/zeus-sphinx-revamped-as-coronavirus-scams-continue\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/zeus-sphinx-revamped-as-coronavirus-scams-continue\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/05\/zeus-sphinx-revamped-as-coronavirus-scams-continue.png","datePublished":"2020-05-11T15:15:55+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/zeus-sphinx-revamped-as-coronavirus-scams-continue\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/zeus-sphinx-revamped-as-coronavirus-scams-continue\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/zeus-sphinx-revamped-as-coronavirus-scams-continue\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/05\/zeus-sphinx-revamped-as-coronavirus-scams-continue.png","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/05\/zeus-sphinx-revamped-as-coronavirus-scams-continue.png","width":770,"height":578},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/zeus-sphinx-revamped-as-coronavirus-scams-continue\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"headline,malware,cybercrime,fraud","item":"https:\/\/www.threatshub.org\/blog\/tag\/headlinemalwarecybercrimefraud\/"},{"@type":"ListItem","position":3,"name":"Zeus Sphinx Revamped As Coronavirus Scams Continue"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/34924","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=34924"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/34924\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/34925"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=34924"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=34924"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=34924"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}