Mobile banking malware in LATAM: what do security teams need to act on?

TL;DR: 34 malware families are targeting 1,243 mobile banking and fintech apps across 90 countries, with 21 families focused on 68 core banking and fintech apps across 12 LATAM countries, according to Zimperium; attackers are using AI across localisation, exploit scripting, and phishing overlays. The threat now sits at the device layer, where fake screens, accessibility abuse, OTP interception, and device takeover undermine mobile trust assumptions.

Editorial analysis by NHI Mgmt Group, based on content published by Zimperium: “Mobile Fraud in 2026: Malware is Actively Targeting Mobile Banking Apps in LATAM”.

Key questions

Q: What breaks when mobile banking apps do not use app shielding and secure session controls?

A: Without app shielding and proper session controls, fraudsters can reverse-engineer apps, create convincing fake apps, steal data from the app itself, or exploit open sessions.

Q: Why do evolving mobile malware campaigns increase account takeover risk?

A: They increase risk because the same device can remain usable to the user while malware quietly captures credentials, OTP codes, or transaction data.

Q: What signs indicate that a mobile banking session is being abused?

A: Common indicators include accessibility-service misuse, unexpected overlays, root or jailbreak signals, emulator use, suspicious screen-sharing activity, and OTP flows that do not match normal customer behaviour.

Practitioner guidance

• Harden the mobile app against tampering Build resistance to reverse engineering, hooking, and instrumentation so attackers cannot easily study or alter the banking app before deploying fraud tooling.
• Detect runtime abuse on the device Instrument the app to flag rooting, jailbreak, debuggers, emulators, accessibility abuse, and Frida-style hooking during active sessions.
• Treat overlays as transaction-risk signals Block or step up when the app detects overlay patterns, fake screens, or UI interactions that do not match expected user navigation.

Bottom line: Mobile banking fraud now exploits the device interaction layer, not just stolen credentials or weak passwords.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →