Apparently the new Dyer malware is bypassing SSL to swipe bank credentials. I read that it's using "process hooks" to hook the browsers and see the data BEFORE it is encrypted and sent to the bank server (using the keys from the initial SSL handshake). Can someone elaborate as to how this is achieved? and is this at the same threat level of a keylogger capturing your keystrokes or is it more covert and dangerous?
When an application "uses SSL", it actually loads a system DLL which implements the protocol. Each process maintains, in a specific zone of its address space, the list of DLL it has already loaded and where (this is under the management of the dynamic linker); a malware that can run on your system with enough local privileges will simply poke into these memory structures so that when the application wants to load the SSL implementation, it is actually redirected to a malware-controlled DLL. The malware will faithfully forward all calls to the true SSL-implementing DLL, but will also keep a copy of the data.
All these manipulations are in RAM and thus leave no permanent trace. Of course, the malware still has to "be there" and it wants to resist reboots, so it will normally leave a hook somewhere, modifying a system DLL or executable so that it is invoked again when the machine reboots.
(Nobody knows why any specific vulnerability or malware suddenly becomes the most important news in a decade and triggers a worldwide panic, while dozens of similar or even more dangerous virus just fly by with nothing more than a collective "meh" from a few specialist. The "heartbleed" case is a good example of a bug going viral for no perceivable reason.)