InfoSecBulletin Cybersecurity for mankind
The research uncovered that 29 malware families targeted 1,800 banking applications across 61 countries last year. In comparison, the 2022 report uncovered 10 prolific malware families targeting 600 banking apps.
Traditional banking apps are the main target, with 1,103 compromised apps, accounting for 61% of the total. FinTech and Trading apps make up the remaining 39%.
CVSS 10.0 Flaw
Critical flaw in Siemens OZW Web Servers Enable Unauthenticated RCE
Microsoft Patch Tuesday May 2025: 72 flaws, 5 Actively Exploited Zero-Day
OTP glitch disrupted NID services across the country
Google to pay Texas $1.4 billion for location tracking practices
YouTube geo-blocks at least 4 Bangladeshi TV channels in India
Microsoft Patches Four Critical Azure and Power Apps Vulns
Qilin Ransomware topped April 2025 with 45+ data leak disclosures
SonicWall Patches 3 Flaws in SMA 100 Devices
Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed
Critical (CVSS 10) Flaw in Cisco IOS XE WLCs Allows RRA
The top banking malware families are Hook, Godfather, and Teabot. These families have targeted the most banks. In the 2022 report, 19 malware families were mentioned, and they have developed new capabilities. Additionally, ten new families have been recognized as a threat in 2023.
Banking trojans are getting smarter and more successful at tricking mobile devices. They can avoid security measures and go undetected. Traditional security methods are struggling to keep up with the growing threat.
US banks are the most targeted by financially motivated cyber threats. 109 banks in the US were targeted by banking malware in 2023. In comparison, the UK and Italy had 48 and 44 targeted banks, respectively. Additionally, trojans are now targeting more than just banking apps. They are also targeting cryptocurrency, social media, and messaging apps.
“Mobile banking security is currently in a high-stakes scenario, with numerous threat actors posing substantial risks. This report shows the sophistication, adaptability, and scalability of banking trojans and their widespread impact on mobile applications across the globe,” said Nico Chiaraviglio, Chief Scientist of Zimperium. “We are seeing that they are finding ways to bypass traditional defenses, which is why it is critical that banking and financial organizations employ comprehensive, real-time, on-device mobile security to combat these intelligent adversaries.
New capabilities in emerging banking malware families:
Automated Transfer System (ATS): A technique that facilitates unauthorized transfers of money.
Telephone-based Attack Delivery (TOAD): Involves a follow-up call to gain trust and download more malware.
Screen Sharing: Being able to remotely control a victim’s device without having physical access to it.
Malware-as-a-Service (MaaS): An online business model offering malware creation tools for rent or sale, facilitating easy execution of cyberattacks.
These findings show that the mobile threat landscape is growing and changing. We need to prioritize mobile security and have a comprehensive strategy that focuses on fighting mobile banking trojans. Instead of just reacting to threats, organizations should be proactive and have real-time visibility and protection against threats. This means moving away from a standard-based approach and considering real-world threats.
“By monitoring millions of devices, Zimperium has identified alarming figures highlighting how widespread, global, and successful mobile banking malware can be,” said Jon Paterson, CTO at Zimperium. “Cybercriminals continue to target traditional banking apps and FinTech & Trading apps because of the widespread use of dated app security techniques that are falling short.”
