Financial Services Malware Statistics

TsarBot targeted 450 banking apps and accounted for 58% of its global activity.

CopyBara targeted 446 banking apps.

Nexus concentrated 90% of its global targets in EMEA.

Hook targeted 385 banking apps.

34 malware families targeted 1,243 mobile banking and fintech apps across 90 countries globally.

In EMEA, 30 mobile malware families targeted over 800 banking and fintech applications across 44 countries.

TsarBot, CopyBara, and Hook collectively targeted more than 60% banking and fintech apps.

The United States had 162 banking apps under active targeting, the highest concentration of any single country globally.

Ukraine, Russia, and the United States are the top three countries hosting command-and-control infrastructure across the malware families analyzed.

Malware activity averaged 39,341 hits per firewall in the first half of 2026, giving financial services the second-highest per-device malware intensity of any industry, behind only healthcare.

Ten ransomware families were active against the financial services sector in the first half of 2026, including REvil (Sodinokibi) and Prometheus.

Nearly half of the active malware families have financial extortion capabilities, including ransomware that can encrypt files on the device.

Android malware-driven financial transactions increase 67% year-over-year.

Thirty-four active malware families targeted 1,243 financial apps across 90 countries.

TsarBot, CopyBara, and Hook collectively targeted more than 60% of global banking and fintech apps.