Mobile Banking Trojans Surge, Doubling in Volume
Mobile malware developers were busy bees in 2022, flooding the cybercrime landscape with twice the number of banking Trojans than the year before.
February 27, 2023
![two hands holding a mobile phone two hands holding a mobile phone](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt745fd76bc83de8a8/64f15292f111049cf41bf571/Mobile_hanohikirf_Alamy.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
Nearly 200,000 new mobile banking Trojans emerged in 2022 — a 100% increase from the year before and the biggest acceleration of mobile malware development seen in the last six years.
That's according to Kaspersky's "Mobile Threats in 2022" report, which also detailed that the firm detected 1.6 million installers for mobile malware within its telemetry during the year. That's actually a decline in threat activity (down from 3.5 million in 2021 and 5.7 million in 2020), even as malware creation surges ahead.
"This drastic increase [in banking Trojan development] signifies that cybercriminals are targeting mobile users and are increasingly more interested in stealing financial data and actively investing in the creation of new malware," according to the report, released today. It added, "The cybercriminal activity leveled off in 2022, with attack numbers remaining steady after a decrease in 2021. That said, cybercriminals are still working on improving both malware functionality and spread vectors."
Banking Trojans are built to steal mobile bank account credentials or e-payment details, but they can often be repurposed for other kinds of data theft or used to install additional malware. Infamous malware strains like Emotet and TrickBot, for instance, began life as banking Trojans and quickly evolved to become something much more all-purpose.
Kaspersky's report noted that while unofficial app stores of course pose the greatest potential for encountering a banking Trojan, Google Play has been repeatedly populated with "downloaders for banking trojan families, such as Sharkbot, Anatsa/Teaban, Octo/Coper, and Xenomorph, all disguised as utilities."
Sharkbot, for instance, was found masquerading as a file manager that seems benign (and can evade Google's vetting process) — until it's installed. At that point, it requests permission to install additional packages that will together carry out the malicious banking Trojan activity.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024