Mobile banking malware in APJ is widening fraud exposure

At a glance

What this is: This research maps how mobile banking malware is targeting fintech apps globally, with APJ especially concentrated, and shows that attackers are using AI throughout the fraud chain.

Why it matters: It matters because mobile banking teams now have to govern device trust, runtime manipulation, and OTP abuse as part of identity and transaction security, not just app hardening.

By the numbers:

• 34 malware families targeting 1,243 mobile banking and fintech apps across 90 countries globally were identified in the research.
• In APJ, 24 malware families are actively targeting 214 core banking and fintech apps across 19 countries.
• Australia has 50 banking apps targeted, the highest country count listed in the APJ breakdown.
• India has 42 banking apps targeted in the APJ breakdown.

Context

Mobile banking fraud now starts on the device itself, where malware can observe the user, intercept one-time passwords, and impersonate legitimate behaviour inside the app. The core governance gap is that mobile trust cannot be assumed simply because an app is installed from a known channel or wrapped in standard app controls.

The article also shows that attackers are adapting tactics regionally, with local language lures, regional payment rails, and device takeover techniques that make fraud detection harder. For teams responsible for mobile app security and transaction integrity, the problem spans app resilience, device posture, and customer trust.

Key questions

Q: What breaks when banks rely on SMS OTP as the only transaction authentication method?

A: Banks expose themselves to account takeover and transaction fraud because a stolen or relayed OTP proves only that a code was received, not that the session, device, or transaction is trustworthy. Once the attacker controls the channel or the user is socially engineered, the code becomes a weak hurdle rather than a real assurance step.

Q: Why do mobile banking malware campaigns create more risk than credential theft alone?

A: Because they compromise the point where the customer makes trust decisions. Overlay phishing, keylogging, and device takeover can steal credentials, OTPs, and approvals while the app still appears legitimate. That means the attacker is not only stealing identity material, but also replacing the trust signal the user relies on to authorise payment or access.

Q: How can security teams tell whether a mobile banking app is being abused at runtime?

A: Look for indicators such as unexplained accessibility activation, overlay behaviour, screen sharing, hooking frameworks, emulator use, or device takeover patterns during sensitive transactions. Those signals suggest the app or device is being manipulated, even if the login appears successful.

Q: What should banks do when mobile malware is using AI to improve fraud campaigns?

A: Banks should assume phishing content, overlays, and evasion will iterate faster than signature-based detection. The practical response is to combine behavioural fraud analytics, runtime protection, and device integrity checks so the control plane can adapt as quickly as the attacker does.

Technical breakdown

How accessibility abuse turns a phone into a fraud channel

Android accessibility permissions can be abused to read screen content, capture lock patterns or passwords, and trigger actions that the user did not intend. Once granted, those permissions can let malware interact with the interface as if it were a legitimate user aid, which is why this abuse path is so effective for banking trojans. The attacker does not need to break the app first; they exploit the operating system’s trust model around assistive functions and then layer phishing, overlay, or device takeover on top. See the Mobile Malware Guide. See the Mobile Malware Guide.

Practical implication: restrict accessibility exposure in mobile risk reviews and treat unexpected accessibility activation as a high-signal fraud indicator.

Why overlays and remote device takeover defeat app-level trust

Screen overlays, remote access tools, and device takeover techniques let malware present fake login forms, observe the user in real time, or drive gestures directly on the victim device. That collapses the distinction between a legitimate session and a manipulated one, especially when the app has no way to distinguish human intent from malware-driven interaction. In fraud terms, this is not merely credential theft. It is session substitution, where the attacker operates inside the customer’s trusted device context and can complete actions that would otherwise trigger scrutiny.

Practical implication: add runtime signals that detect overlaying, hooking, screen sharing, and remote control rather than relying on login-time checks alone.

How OTP interception and AI-assisted lures extend fraud lifecycle coverage

OTP interception bypasses a common second factor by capturing SMS content or notifications before the user can complete authentication. At the same time, AI-assisted localization, phishing-page generation, and overlay refinement reduce the friction attackers normally face when scaling campaigns across countries and languages. The important technical point is that AI is not doing one isolated task. It is being used to improve each stage of the campaign, from lure construction to evasion and transfer completion, which raises the success rate of mobile fraud operations.

Practical implication: assume fraud tooling will iterate quickly and pair OTP controls with anti-phishing, device attestation, and transaction risk scoring.

Threat narrative

Attacker objective: The attacker wants to take over the mobile session, bypass MFA, and complete fraudulent transfers without the victim or bank stopping the transaction.

1. Entry occurs when victims are lured into installing or opening a trojanised mobile banking or messaging app that abuses local trust and regional language cues.
2. Credential harvesting follows when malware uses accessibility services, overlays, screen recording, or SMS interception to capture passwords, OTPs, and session inputs.
3. Escalation and impact occur when the attacker uses device takeover or automated transfer functions to act as the victim and complete unauthorised banking activity.

Breaches seen in the wild

• CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.
• Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Mobile fraud is now a device trust problem, not just an application security problem. The article makes clear that the attacker’s control point is often the phone itself, where accessibility permissions, overlays, and remote control can defeat the assumptions behind mobile authentication. That means app hardening alone is insufficient if runtime trust is not continuously re-evaluated. Practitioners should treat the device as part of the identity boundary, not as a neutral endpoint.

AI-assisted fraud changes the economics of mobile malware operations. The most important shift is not that attackers use AI in one feature, but that they use it to scale localisation, phishing, evasive packing, and overlay construction together. That reduces campaign cost and speeds up adaptation across regions and languages. Security teams should assume faster mutation and shorter detection windows, which makes behaviour-based control more important than signature dependence.

There is a named governance gap here: session substitution. The attacker is not merely stealing credentials, but substituting a manipulated device session for a legitimate customer session inside the bank’s trust model. That gap matters because OTP success, app launch, and even clean UI telemetry can still coexist with malicious control. Teams should design controls that verify session integrity at runtime, not just identity at login.

Regional fraud patterns require regional control tuning. APJ-targeted malware is adapted to local banks, language, and payment behaviours, so generic mobile risk settings will miss part of the threat surface. This is where mobile security governance and identity fraud governance converge. Practitioners should align mobile detection, fraud analytics, and customer journey controls to the markets they actually serve.

From our research library:

• Nearly 60% of companies reported that fraud losses were still increasing in 2025.

What this signals

Session substitution: Mobile fraud defenders should use this concept for attacks where the customer authenticates normally but malware replaces the intended session with one controlled on the device. The governance response shifts from checking credentials to verifying that the session itself has not been hijacked.

Banks need to stop treating mobile app security and fraud operations as separate lanes. When the device, the app, and the payment flow are all part of the attack surface, controls have to correlate runtime behaviour, transaction risk, and identity assurance in one decision path.

For practitioners

• Harden the mobile runtime Detect rooting, jailbreaking, hooking frameworks, emulators, and screen overlay behaviour during live sessions so manipulated devices lose trust before a transfer is completed.
• Treat accessibility permission abuse as a fraud signal Flag unexpected accessibility service activation, permission escalation, or automation-like UI behaviour as a high-priority indicator of potential device takeover.
• Add transaction-step controls for OTP and transfer risk Combine OTP interception detection, device reputation, and behavioural transaction scoring so a captured factor does not automatically permit payment execution.
• Test the app against AI-assisted malware tradecraft Exercise your banking app against localized phishing, dynamic overlays, real-time screen capture, and remote-control abuse to see where the customer journey breaks.

Key takeaways

• Mobile banking malware now targets the device context, which means user trust can be compromised even when app authentication appears normal.
• The research shows broad scale, with 34 malware families targeting 1,243 apps globally and 24 families targeting 214 apps across 19 APJ countries.
• Banks need runtime protection, device integrity checks, and fraud analytics that can spot session substitution rather than relying on static login controls alone.

Related NHI Mgmt Group resources: Mobile App Security Guide · Mobile Malware Guide · Authorised Push Payment (APP) Fraud Guide · Mobile App Security Testing Guide

Key terms

• Accessibility abuse: The misuse of built-in operating system accessibility features to observe the screen, capture input, overlay content, or automate app interaction. The feature is legitimate, but when an attacker controls it, the result is covert session manipulation that is difficult to distinguish from normal device behaviour.
• Screen Overlay Attack: A screen overlay attack uses a fake interface layered over a legitimate mobile app to capture credentials or other sensitive input. It is often aimed at banking and payment applications, where users expect to enter high-value information. The deception works because the fake screen closely matches the real app experience.
• Device Takeover: A fraud pattern in which the attacker uses a compromised or trusted device to inherit reputation and bypass normal risk checks. Because the device appears familiar, merchants may trust the session even though the real user no longer controls the endpoint or associated authentication factors.
• Session Substitution: A fraud pattern where the attacker replaces the legitimate user’s active session with one controlled through malware or remote access. The victim may appear authenticated, but the transaction or interaction is effectively being driven by the attacker from within the trusted device context.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.