Skip to content

Topic

Mobile Banking Fraud

Criminal schemes exploiting mobile banking apps, malware, or stolen credentials to steal funds or open credit in a victim's name.

Current stories

securityOne report1 publisher

GhostBat RAT now watches 60 Indian finance apps for PINs, Cyble reports

Cyble says GhostBat RAT, spread by fake mParivahan and eChallan traffic-fine texts, now monitors 60 Indian banking, UPI and wallet apps for PINs. Its invisible-keypad overlay targets only Google Pay and MobiKwik.

Reality

Evidence50
Adoption20
Hype gap+10
Incentives40
Confidence55
securityOne report1 publisher

Banks expand behavioural checks before mobile payments are authorised

Banking scams targeting mobile users rose 35% in 12 months, according to research cited by Tech Radar. Because victims send the money themselves, banks are looking for signs of manipulation before a payment is authorised.

Publishers:scworld.com

Reality

Evidence28
Adoption
Not scored
Hype gap+25
Incentives
Not scored
Confidence32
securityOne report1 publisher

BioCatch counts a 258% rise in employment scam victims at more than 370 banks

BioCatch says employment scam victims rose 258% in a year at more than 370 banks in 21 countries, against 35% growth for all reported scams. Nine in ten scam sessions now start on a phone, so the signs of a coached victim have to be read inside the mobile session.

Reality

Evidence45
Adoption
Not scored
Hype gap+15
Incentives65
Confidence50
securityConfirmed4 publishers

Manic's fallback channel: Android malware that exfiltrates through the phone next to yours

ThreatFabric says the Android spyware encrypts stolen data and relays it over Wi-Fi Direct and Bluetooth when it cannot reach its C2, using up to four hops by default.

Publishers:bleepingcomputer.com securityaffairs.com thehackernews.com threatfabric.com

Perspective Coverage

4 publishers
Builder
Builder 36%
Operator
Operator 58%
Investor
Investor 6%

Reality

Evidence65
Adoption
Not scored
Hype gap+20
Incentives35
Confidence68
securityConfirmed3 publishers

Gigabud creates an Android work profile to put its fake bank app out of the scanner's reach

Group-IB says a second app sets up the work profile within minutes of infection and clones a fake bank app into it, so the malware check inside that app looks at an empty room while the trojan runs in the personal space.

Perspective Coverage

3 publishers
Builder
Builder 23%
Operator
Operator 67%
Investor
Investor 10%

Reality

Evidence55
Adoption30
Hype gap+15
Incentives50
Confidence60
buildOne report1 publisher

Gigabud clones a banking app into an Android work profile to register a new device

The malware asks for accessibility, then has a second component build a work profile and copy the bank app into it. Group-IB says the clone registers with the bank as a new device while a black screen hides the transfer.

Publishers:dev.to

Reality

Evidence42
Adoption38
Hype gap+12
Incentives34
Confidence48
securityOne report1 publisher

Meta ads drove nearly 15,000 PanDa RAT installs in Mexico in one week

Intel 471 found an unauthenticated panel called AppPanda running fake streaming lures behind paid Facebook ads, with affiliate tooling that re-signs the Android payload every hour and tracks ad spend the way a growth team would.

Publishers:intel471.com

Reality

Evidence64
Adoption74
Hype gap+15
Incentives58
Confidence56