Mobile banking fraud now spans 34 malware families globally

At a glance

What this is: This is a mobile threat research summary showing that banking fraud is increasingly driven by malware families targeting mobile banking and fintech apps at scale.

Why it matters: It matters because mobile banking and fintech teams now have to govern device trust, runtime integrity, and fraud controls as part of identity assurance, not as a separate mobile security problem.

By the numbers:

• 34 malware families targeting 1,243 mobile banking and fintech apps across 90 countries globally
• 26 mobile malware families are actively targeting over 189 banking and fintech applications in the US and Canada
• 162 banking and fintech apps are being targeted by 26 active malware families in the United States
• 27 banking and fintech apps are being targeted by 20 active malware families in Canada

Context

Mobile banking fraud is no longer just a phishing problem. It now depends on device compromise, overlay abuse, credential theft, and app manipulation, which means the control boundary has moved from the login page to the handset itself.

In this environment, application integrity, runtime protection, and anti-tampering controls become part of the trust model for financial access. The article shows that attackers are using AI to localise lures and generate harder-to-detect overlays, which makes the fraud chain more adaptive than classic signature-led defence.

Key questions

Q: What should mobile banking teams do first when device-based fraud is targeting their apps?

A: Start with runtime integrity controls that can detect tampering, rooting, jailbreaks, overlays, and suspicious automation before a sensitive session is allowed to proceed. The first objective is to stop the device from becoming the fraud environment. If the user interface cannot be trusted, authentication strength alone will not protect the transaction.

Q: Why do mobile banking malware campaigns create more risk than credential theft alone?

A: Because they compromise the point where the customer makes trust decisions. Overlay phishing, keylogging, and device takeover can steal credentials, OTPs, and approvals while the app still appears legitimate. That means the attacker is not only stealing identity material, but also replacing the trust signal the user relies on to authorise payment or access.

Q: How can security teams tell whether mobile fraud controls are working?

A: Look for earlier containment, not just better post-event detection. Effective controls reduce successful tampering, lower the rate of suspicious onboarding or payment sessions, and produce reliable attestation or runtime integrity signals before the transaction is authorised. If the team only learns about abuse after reimbursement or dispute handling, the controls are still too reactive.

Q: Should organisations prioritise runtime controls over malware signatures for mobile fraud defence?

A: Yes, when the threat model includes fast-changing malware families and AI-assisted variation. Signatures still matter, but they lag behind new samples and altered overlays. Runtime controls are better for catching the conditions that make mobile fraud possible, especially when the attacker is using the device itself as the attack surface.

Technical breakdown

How mobile banking malware turns the device into the fraud layer

Mobile banking malware usually works by inserting itself between the user and the legitimate app. Techniques such as overlays, screen capture, accessibility abuse, keylogging, and device takeover let the attacker observe or manipulate authentication and transaction flows without needing to break the backend directly. When malware can imitate the real app at the point of use, the trust decision moves to the endpoint, not the server. That is why mobile fraud is both a malware problem and an identity problem: the attacker is exploiting the device as the authentication environment. See the Mobile App Security Guide.

Practical implication: Treat the mobile device as part of the access control plane and verify app integrity before high-risk transactions.

Why AI makes mobile fraud campaigns harder to detect

AI changes mobile malware operations by speeding up content generation, localisation, exploit adaptation, and lure refinement. That does not make the malware itself magically autonomous, but it does make each stage of the campaign faster to produce and harder to fingerprint. The result is more variation across the same underlying attack pattern, which weakens controls that rely on static indicators or known samples. For security teams, the practical shift is from matching known malware to detecting behaviour that indicates fraud intent, tampering, or suspicious runtime conditions. See the Malware Guide.

Practical implication: Use behaviour-based detection and runtime signals instead of relying only on known-malware signatures.

What overlay phishing means for mobile identity and session trust

Overlay phishing replaces the legitimate screen with a convincing fake login or approval prompt, often while the genuine app continues running underneath. That creates a direct trust failure at the session layer: the user believes they are approving a valid action, while the malware is harvesting credentials, one-time codes, or transaction approvals. In identity terms, the compromise is not just credential theft. It is session deception, where the trust signal presented to the user has been substituted before the action is complete. This is especially dangerous in financial apps because approval workflows are designed for speed.

Practical implication: Add anti-overlay checks, step-up signals, and transaction verification that are resistant to screen substitution.

Threat narrative

Attacker objective: The attacker wants to hijack mobile banking sessions, steal authentication factors, and execute fraudulent transactions without being detected.

1. Entry begins with a mobile infection vector such as a malicious app, scam delivery, or a tampered payload that reaches the handset.
2. Credential access follows through keylogging, overlay phishing, screen capture, or device takeover that exposes banking credentials and 2FA codes.
3. Escalation occurs when the malware manipulates the banking session, approves fraudulent actions, or enables remote control of the device.
4. Impact is fraudulent account access, stolen authentication data, and financial loss through compromised mobile banking sessions.

Breaches seen in the wild

• CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Mobile fraud is now a device trust problem, not only a banking-app problem. When malware can sit in front of the user, the app may still be intact while the session is already compromised. That shifts governance toward runtime integrity, device posture, and approval-flow assurance rather than only backend authentication. Financial security teams should treat the handset as part of the control boundary.

AI-assisted malware production widens the variation space faster than signature-based control models can absorb it. The article shows attackers using AI to localise lures, script exploits, and make overlays harder to distinguish from the real thing. That does not eliminate the need for malware detection, but it does mean known-bad matching is no longer enough for mobile fraud defence. Practitioners should expect behavioural drift and prepare for continuous control tuning.

Session deception is the central failure mode in mobile banking fraud. The issue is not simply that credentials are stolen. It is that the user is induced to interact with a counterfeit layer while the legitimate app continues to operate in the background. That makes runtime attestation, anti-overlay controls, and transaction-risk checks core governance capabilities, not optional enhancements. Security leaders should align fraud controls to the point where trust is actually consumed.

Mobile banking teams need a named concept for this pattern: runtime trust collapse. That is the moment when device compromise, visual deception, and identity reuse converge to make an otherwise valid mobile session untrustworthy. The article’s malware families show that this collapse can happen in the customer channel without any direct server compromise. Practitioner implication: govern mobile access as a runtime trust problem, not a static authentication event.

From our research library:

• Nearly 60% of companies reported that fraud losses were still increasing in 2025.

What this signals

Mobile fraud control is becoming a session-governance discipline. Financial organisations should expect more attacks that target the trust relationship between user, device, and transaction flow rather than the backend alone. That means fraud monitoring, runtime attestation, and identity assurance need to converge in the same operating model.

AI-assisted adversary tooling increases the need for adaptive detection. When lures, overlays, and exploit scripts can be localised and iterated quickly, teams need controls that look for behaviour, not just known indicators. Static detections alone will not keep pace with the variation rate of modern mobile malware.

For practitioners

• Harden the mobile app against tampering Reduce the usefulness of reverse engineering, debugger attachment, hooking frameworks, and emulator-based analysis so attackers cannot easily inspect or modify app behaviour.
• Enable runtime protection for mobile sessions Detect root, jailbreak, accessibility abuse, screen manipulation, and suspicious runtime conditions before allowing high-risk banking actions.
• Add anti-overlay and transaction-verification checks Make approval screens harder to spoof and require stronger verification when the app detects display substitution or abnormal interaction paths.
• Move from signature-led detection to behaviour-based defence Prioritise controls that identify fraud behaviour and device compromise patterns because new malware variants appear faster than signatures can be written.

Key takeaways

• Mobile banking fraud is increasingly driven by malware that compromises the handset and manipulates the session, not just by phishing against the login page.
• The article cites 34 malware families targeting 1,243 mobile banking and fintech apps across 90 countries, showing that the problem is broad and operational, not isolated.
• Runtime protection, anti-overlay checks, and behavioural detection are the controls most likely to reduce impact when attackers use the device as the fraud layer.

Related NHI Mgmt Group resources: Mobile App Security Guide · Mobile Device Security Guide · Mobile App Security Testing Guide · Malware Guide

Key terms

• Banking Malware: Banking malware is malicious software designed to steal credentials or financial information from banking systems and related applications. It often disguises itself as a legitimate tool, uses obfuscation or backdoors, and may activate only after a remote command. The goal is usually credential theft, account takeover, or fraudulent transactions.
• Overlay Phishing: Overlay phishing is the use of a fake screen placed over a legitimate mobile app to harvest credentials or transaction approvals. The user believes they are interacting with the real application while the malware captures inputs or alters what is shown.
• Runtime Protection: Runtime protection is a control model that observes application behavior while software is running and blocks unsafe actions as they occur. In Java estates, it helps distinguish active exploit paths from dormant vulnerable code, which is essential when patching is delayed or impossible.
• Device Takeover: A fraud pattern in which the attacker uses a compromised or trusted device to inherit reputation and bypass normal risk checks. Because the device appears familiar, merchants may trust the session even though the real user no longer controls the endpoint or associated authentication factors.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.