Marcher Trojan is a mobile banking malware family that steals credentials and payment data from infected Android devices. It typically overlays fake login screens on legitimate apps, intercepts text messages, and can capture banking, card, and authentication details to enable account takeover and fraudulent transactions.
What Marcher Trojan Is Used For
Marcher Trojan is mobile banking malware built to steal financial credentials and payment data from Android devices. It is dangerous because it targets the point where users authenticate, approve transactions, and receive one-time codes, which can turn a device compromise into account takeover or fraudulent payments.
How Marcher Trojan Works
The family is commonly associated with overlay attacks, where a fake login screen is shown on top of a real banking app to capture usernames, passwords, and card details. It also intercepts text messages, which can expose authentication codes and other sensitive account activity.
Why Marcher Trojan Matters to Security Teams
Marcher demonstrates how mobile malware can bypass ordinary user trust in a legitimate app by manipulating the interface rather than breaking encryption or network defenses. That makes it especially effective against banking, payment, and authentication workflows that rely on the device as a trusted endpoint.
Because the malware captures both static credentials and session-enabling data such as SMS codes, the compromise can extend beyond a single password and into fraudulent transfers, card misuse, and identity abuse.
Defending Against Marcher Trojan
Defence depends on reducing the chance that a malicious app can be installed, overlay other apps, or read sensitive messages. On managed fleets, mobile device controls, app vetting, and least-privilege permissions matter because the malware needs broad device access to persist and harvest data. For a control baseline, teams can map mobile hardening and monitoring to NIST SP 800-53 Rev 5 Security and Privacy Controls and align endpoint verification and transaction protection with NIST Cybersecurity Framework 2.0.
For detection, watch for suspicious accessibility abuse, unusual SMS interception behaviour, app overlay prompts, and logins that originate from a device showing signs of compromise. Where banking or payment apps are in scope, anti-phishing-resistant authentication and stronger device trust checks can help limit the value of stolen credentials, as reflected in NIST SP 800-63 Digital Identity Guidelines and the credential- and access-focused guidance in OWASP API Security Top 10.
Risk and Threat Considerations
Marcher-style banking malware is high risk because it converts a single infected phone into a credential theft and transaction fraud platform. The main danger is not just password capture, but the ability to hijack the live authentication flow and exploit trust in the device itself.
Failure mechanism: The malware uses fake overlays and message interception to steal login details and one-time codes, then reuses that access to complete account takeover or authorise fraudulent activity.
Impact: Victims can lose access to banking and payment accounts, and organisations can face fraud losses, customer support burden, and downstream investigations into compromised sessions and transactions.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5, OWASP ASVS and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication and Access Control | Marcher steals credentials and codes used for access control on mobile banking flows. |
| DE.CM-01 — Monitoring for Suspicious Activity | The malware’s overlays and SMS interception are detectable through continuous monitoring. | |
| PR.DS-01 — Data-at-Rest Protection | Payment and credential data on the device should be protected against malware theft. | |
| Recommendation — Strengthen mobile authentication and access controls to reduce the value of stolen credentials and session data. Monitor endpoint and account activity for overlay abuse, message interception, and anomalous logins. Protect sensitive mobile data so local compromise yields less usable credential and payment information. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Marcher targets authenticators, credentials, and one-time codes used for account access. |
| SC-18 — Mobile Code | The threat operates through malicious mobile code and app-level abuse on Android devices. | |
| Recommendation — Rotate, restrict, and protect authenticators and related secret material to limit theft value. Control mobile code execution and vet application sources to reduce malware installation risk. | ||
| MITRE ATT&CK | T1056 — Input Capture | Overlay theft and SMS interception are forms of capturing user input and authentication data. |
| T1111 — Multi-Factor Authentication Interception | Intercepting text messages is a common way to steal authentication codes. | |
| Recommendation — Map observed input capture behaviour to T1056 and hunt for credential harvesting on mobile devices. Detect MFA interception patterns and treat SMS-based codes as exposed when the device is compromised. | ||
| OWASP ASVS | V6 — Authentication | The malware abuses authentication workflows to steal and replay credentials. |
| V7 — Session Management | Captured codes and session data can be reused to hijack active sessions. | |
| Recommendation — Harden authentication flows so stolen credentials and intercepted codes are less reusable. Bind sessions tightly to trusted devices and invalidate suspicious session reuse quickly. | ||
| CIS Controls v8 | CIS-10 — Malware Defenses | Marcher is mobile malware, so malware prevention and detection controls are central. |
| Recommendation — Apply malware defenses that reduce installation, execution, and persistence of mobile trojans. | ||
Related resources from NHI Mgmt Group
- What are the signs that a trojan is using persistence and command retrieval to stay hidden?
- What happens when an Android banking trojan is installed on a device used for financial services?
- How should security teams defend software delivery pipelines against Trojan Source style code obfuscation?
- What do teams get wrong when trying to detect Trojan Source attacks?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 24, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org