According to Zimperium, mobile banking is outperforming online banking across all age groups due to its convenience and people’s desire to have those apps readily available. However, this surge has also been accompanied by a dramatic increase in financial fraud.
The study found that 29 malware families targeted 1,800 banking applications in 61 countries last year. In comparison, the 2022 report revealed 10 prolific malware families targeting 600 banking apps.
Banking Trojans continue to target mobile devices
Banking Trojans continue to evolve with their ability to persist, bypass security, and evade detection on mobile devices. As fast-moving threat actors continue to increase their investments, traditional security practices can no longer keep up.
The study found that U.S. banking institutions remain the most targeted targets of financially motivated threat actors. Banking malware targeted 109 US banks in 2023, followed by the UK (48 banking institutions) and Italy (44 banks). The report also notes that Trojans have evolved beyond simple banking apps to target cryptocurrencies, social media, and messaging apps.
“Mobile banking security is currently in a high-stakes scenario with numerous attackers posing significant risks. This report highlights the sophistication, adaptability, and scalability of banking Trojans and their global “We demonstrate widespread implications for mobile applications in China,” said Nico Chiaraviglio, Principal Scientist at Zimperium. “We see that they are finding ways to circumvent traditional defenses. That’s why banks and financial organizations are adopting comprehensive, real-time, on-device mobile security to combat these intelligent adversaries. It is important to do so.”
Traditional banking applications remain the main targets, with a staggering 1,103 infected apps, accounting for 61% of the 1,800 targets, with emerging FinTech and trading apps accounting for the remaining 39%. occupied.
Hook, Godfather, and Teabot are the most popular banking malware families based on the number of banks targeted. The 19 malware families included in the 2022 report have evolved with new capabilities, and 10 new families have been identified as threats in 2023.
New features in emerging banking malware families
- Automatic transport system (ATS): Techniques that facilitate fraudulent money transfers.
- Telephone-based attack delivery (TOAD): Contains follow-up calls to gain trust and download more malware.
- screen sharing: The ability to remotely control a victim’s device without having physical access to it.
- Malware as a Service (MaaS): An online business model that rents or sells malware creation tools to facilitate the execution of cyberattacks.
These findings demonstrate that mobile threats are dynamic and expanding, which requires a comprehensive, autonomous, and unrelenting focus on combating today’s mobile banking Trojans. You need a mobile-first security strategy. As organizations evolve from standards-based approaches to approaches that consider real-world threats, they must adopt proactive, real-time threat visibility and protection rather than reacting to threats.
Jon Paterson, CTO of Zimperium, said: “By monitoring millions of devices, Zimperium has identified startling numbers that highlight how widespread and globally successful mobile banking malware can be.” We continue to target traditional banking apps as well as fintech and trading apps as outdated app security technologies remain widely used and inadequate.”
Protect your apps from malware
To combat these growing threats, businesses must:
Ensure protection as threats grow in sophistication: Advanced code protection techniques strengthen your security posture to the point where the cost and effort of attacking your application outweighs the attacker’s potential benefit.
Implement runtime visibility for comprehensive threat monitoring and modeling.: Mobile application security leaders need to enable runtime visibility across a variety of threat vectors, including devices, networks, applications, and phishing. This real-time insight enables active identification and reporting of risks, threats, and attacks.
Deploy on-device protection to respond to real-time threats: Mobile application security leaders should prioritize implementing on-device protection mechanisms that allow apps to respond as soon as they detect threats. The ability to perform this action must be autonomous and not rely on network connectivity or backend server communication.
With increasing fraud losses, increasing operational costs, and decreasing consumer trust and brand influence, it’s clear that banking malware is evolving to make mobile banking fraud even more prevalent.