Mobile banking trojans expand capabilites; 66% now allow full device takeover

The threat of mobile banking trojans significantly expanded in 2025, with two-thirds of malware families now enabling full device control and 45% enabling financial extortion, including ransomware, Zimperium’s zLabs research team revealed Tuesday.

Zimperium’s 2026 Mobile Banking Heist Report highlighted advancements over the last year based on the analysis of 34 active mobile malware families targeting a total of 1,243 financial brands across 90 countries. The United States was noted to have the greatest number of affected brands, with a total of 162 U.S. banking apps targeted by mobile malware.

Overall, banking trojan attacks on Android smartphones increased by 56% last year, according to Zimperium, with the total number of unique banking trojan installation packages rising to 255,090, a 271% year-over-year increase. About one in every 20 verification attempts to online financial services is estimated to be fraudulent as of 2025, and 80% of financial fraud events now occur on online or mobile platforms, the report stated.

The researchers highlighted that mobile banking malware evolved past traditional account takeover that focused on stealing user credentials and one-time passwords to more advanced transaction takeover techniques and full device control.

Rather than intercepting notifications or using remote screensharing tools to swipe passwords for later use, modern banking malware focuses on initiating fraudulent transactions directly from a user’s device, making the transactions appear more legitimate. This is increasingly achieved through remote control capabilities, which typically abuse accessibility features to enable remote tap, swipe and keyboard inputs, paired with overlays or black screens to hide the malicious activity from users.

Session cookie theft, the use of brand-impersonating overlays to steal credentials and transaction hijacking through NFC relay were also noted to have increased in 2025, with such capabilities made easily accessible to less-skilled threat actors through malware-as-a-service (MaaS) offerings.

“We’ve seen an evolution of banking trojans into broader account takeover and surveillance platforms, blurring the line between financial malware and spyware,” noted Boris Cipot, principal security engineer at Black Duck, in comments to SC Media. “Given the ongoing growth of mobile-first services and the reliance on mobile-based authentication, it is highly likely we will see more malware adopting this model, with increasing automation and deeper evasion capabilities.”

Overall, 25 malware families — 66% of all families studied — now enable full device control, and 76% provide transaction takeover capabilities. Nearly half (45%) enable financial extortion, including ransomware modules that encrypt files stored on mobile devices and typically demand cryptocurrency payments to regain access.

The top three malware families targeting the most financial apps — TsarBot, CopyBara and Hook — collectively cover 60% of all global financial apps, with TsarBot alone targeting 711 banking apps and 90 fintech apps such as cryptocurrency wallets. North America was noted to be heavily targeted by the Godfather and Teabot malware families, which focus on device takeover and session manipulation to bypass strong authentication controls, Zimperium said.

AI was noted to play a role in advancement of mobile banking malware, as large language models (LLMs) make it easier for malware developers to reverse engineer targeted apps; Zimperium’s report stated that more than 60% of mobile banking apps lack basic code protection, enabling attackers to easily understand their API structure, authentication logic and transaction workflows and tailor their malware around this architecture.

AI is also used by attackers to create deepfakes that can bypass biometric and electronic Know Your Customer (eKYC) protections, Zimperium said, and to help craft more convincing and accurate branded overlays for credential theft.

Zimperium recommended financial institutions harden their code against reverse engineering, use runtime protections to detect malicious activities such as code injection, overlay injection, keylogging, session manipulation and NFC relay attempts, and recognize the signs of device-level compromise to improve their defenses against mobile malware attacks.

“Organizations should treat mobile devices as full-fledged, high-risk endpoints rather than secondary or less critical access points. This means deploying mobile threat defense solutions that can detect behavioral anomalies such as overlay abuse, accessibility service misuse, and suspicious command-and-control communication, rather than relying solely on signature-based detection,” Cipot added. “They should enforce strict policies that prevent sideloading and installation from untrusted sources, as this remains a primary infection vector.”