A banking trojan is malware designed to steal online banking credentials, payment card data and one-time codes, or to manipulate transactions directly from the victim’s device.
How banking trojans work
Like any trojan, a banking trojan hides inside something the user willingly installs – a fake app, an email attachment or a pirated program. Once active, it uses one or more techniques:
- Web injects – inserting extra fields or fake pages into the real bank website in the browser.
- Form grabbing and keylogging – capturing logins as they are typed or submitted.
- Overlay attacks – on Android, drawing a fake login screen on top of the genuine banking app.
- SMS and notification interception – stealing one-time passwords to approve fraudulent transfers.
- Remote control – abusing accessibility services to perform transactions on the device itself, bypassing device-fingerprint checks.
Notable banking trojans
- Zeus (2007) – one of the most influential; its source code leaked in 2011 and spawned many variants.
- Dridex and TrickBot – desktop bankers spread through spam that later evolved into ransomware delivery platforms.
- FluBot – an Android banker spread by SMS that Europol helped take down in 2022.
- Anatsa (TeaBot) and Cerberus – Android families distributed through dropper apps and rented to other criminals.
How to protect against banking trojans
- Install apps only from official stores and refuse accessibility permissions for apps that do not need them.
- Keep the operating system and banking apps up to date.
- Prefer app-based or hardware authentication over SMS codes.
- Check transaction confirmations carefully and contact the bank immediately if anything looks unusual.
Synonyms:
banking malware, banker trojan
