Financial Services Malware Statistics

Malware activity averaged 39,341 hits per firewall in the first half of 2026, giving financial services the second-highest per-device malware intensity of any industry, behind only healthcare.

Ten ransomware families were active against the financial services sector in the first half of 2026, including REvil (Sodinokibi) and Prometheus.

Nearly half of the active malware families have financial extortion capabilities, including ransomware that can encrypt files on the device.

Android malware-driven financial transactions increase 67% year-over-year.

Thirty-four active malware families targeted 1,243 financial apps across 90 countries.

TsarBot, CopyBara, and Hook collectively targeted more than 60% of global banking and fintech apps.