Banking trojans continue to evolve and succeed due to their ability to persist, bypass security, and evade detection on mobile devices. As investment from fast-moving threat actors continues to increase, traditional security practices are unable to keep up. Zimperium, the mobile-first security platform for mobile devices and mobile apps, has released its annual Mobile Banking Heists Report, which highlights the continued evolution and success of mobile banking trojans around the globe.

In particular, the research uncovered that 29 malware families targeted 1,800 banking applications across 61 countries last year. In comparison, last year’s report uncovered 10 prolific malware families targeting 600 banking apps.

The research also revealed that United States banking institutions remain by far the most targeted by financially motivated threat actors. There were 109 U.S. banks targeted by banking malware in 2023, compared to the next most targeted countries which were the U.K. (48 banking institutions) and Italy (44). The report also noted that trojans are evolving beyond simple banking apps, targeting cryptocurrency, social media, and messaging apps.

Other key findings highlighting the real threat of mobile banking malware include:

• Traditional banking applications remain the prime target, with a staggering 1,103 compromised apps —accounting for 61% of the 1800 targets—while the emerging FinTech and Trading apps make up the remaining 39%.
• Hook, Godfather, and Teabot are the top banking malware families, measured by the number of banks targeted.
• The 19 malware families from last year’s report have evolved with new capabilities, and 10 new families have been identified as a threat in 2023.
• New capabilities observed within banking malware this year include:

1. Automated Transfer System (ATS): A technique that facilitates unauthorized transfers of money.
2. Telephone-based Attack Delivery (TOAD): Involves a follow-up call to gain trust and download more malware.
3. Screen Sharing: Being able to remotely control a victim’s device without having physical access to it.
4. Malware-as-a-Service (MaaS): An online business model offering malware creation tools for rent or sale, facilitating easy execution of cyberattacks.

These findings illustrate a dynamic and expanding mobile threat landscape that necessitates the need for a mobile-first security strategy, one that is comprehensive, autonomous, and relentlessly focused on combating today’s mobile banking trojans. Rather than reacting to threats, organizations must embrace proactive real-time threat visibility and protection as we evolve from a standard-based approach to one that factors in real-world threats.

“By monitoring millions of devices, Zimperium has identified alarming figures highlighting how widespread, global, and successful mobile banking malware can be,” said Jon Paterson, Chief Technology Officer at Zimperium. “Cybercriminals continue to target traditional banking apps and FinTech & Trading apps because of the widespread use of dated app security techniques that are falling short. Zimperium enables global businesses to realize the full potential of mobile-powered businesses with its Mobile-First Security Platform that delivers unmatched security across both applications and devices.”