BankingTrojaner

BankingTrojaner is a term used in cybersecurity to describe a class of Trojan horse malware whose primary aim is to steal financial information and banking credentials from users. These threats target online banking sessions, payment platforms, and other financial services by extracting data from browsers, form fields, and sometimes mobile apps. The category encompasses multiple families and variants rather than a single program, and it has evolved to employ modular architectures and evasion techniques.

Common techniques include web injects and form grabbing that capture credentials during login, keystroke logging, and man-in-the-browser capabilities that alter transaction details or circumvent two-factor authentication. Some variants use browser extensions or hooking to intercept data, while others rely on social engineering and malware-delivered payloads to gain access. In some cases, operators use command-and-control servers to update modules, steal data, or receive instructions.

Notable examples observed in the wild include Zeus/Zbot, Dridex, TrickBot, and Kronos. Defenses focus on layered security: keeping operating systems and software up to date, using reputable security products, enabling phishing-resistant authentication, and monitoring for unusual banking activity. Organizations can reduce risk with application whitelisting, network segmentation, and user education about social engineering and suspicious attachments.