Cyble observed the InTheBox threat actor selling over 1,800 web injects in its dark web shop, which can target users from Australia, Japan, Indonesia, the U.S., India, and other countries. The overlays support several Android banking trojans and impersonate apps operated by organizations across the globe. Due to the mass availability and low-cost web injects, threat actors are able to focus on other parts of their operations, including malware development and expansion of their attack surface.