
The initial discovery of Medusa, later dubbed TangleBot, revealed a deeply concerning malware targeting Turkish financial institutions. However, its reach has grown to encompass North America and Europe by 2022. Medusa’s core capability is on-device fraud (ODF), allowing attackers to perform fraudulent transactions directly on compromised devices. The malware’s functionalities include keylogging, screen control, and the ability to read and










