2026 Mobile Banking Heist Report

Nearly half of the active malware families have financial extortion capabilities, including ransomware that can encrypt files on the device.

Android malware-driven financial transactions increase 67% year-over-year.

Thirty-four active malware families targeted 1,243 financial apps across 90 countries.

The United States had the highest concentration of targeted apps globally, with 162 banking applications under active targeting, up from 109 in 2023.

TsarBot, CopyBara, and Hook collectively targeted more than 60% of global banking and fintech apps.