Fraud Anatomy
Mobile banking trojans
and accessibility abuse
A mobile banking trojan is malware built to steal from banking apps. It usually arrives as a fake app, asks for accessibility and overlay permissions, and then watches, copies and taps inside the real banking app.
What is a mobile banking trojan?
A banking trojan hides inside an app that looks harmless, or is delivered as a fake bank app. After install it asks for powerful permissions with a believable reason. Once granted it can see the screen, read notifications and one-time passwords, place fake screens and perform taps without the user touching the phone.
The four techniques that matter
- Overlay: a fake login screen drawn on top of the real app to capture credentials.
- Accessibility abuse: reading screen content and performing taps or text entry on the victim's behalf.
- Notification and SMS interception: capturing one-time passwords as they arrive.
- Remote control: a hidden remote-access channel so an operator can drive the session live.
Why standard checks miss it
The real banking app is genuine, the device is genuine and the customer is genuine. The malware sits between the customer and the app. Server-side checks alone cannot see an overlay or a synthetic tap. The detection has to happen inside the app, on the device, in real time.
How runtime protection responds
- Detect active overlays and accessibility services that are not on an allow-list.
- Detect synthetic input and signs of automation.
- Detect hooking frameworks, tampering and repackaged builds. See Frida detection.
- Verify the device with a hardware-backed check that malware cannot forge.
- Block or step up the session before the transaction is signed.
This is the job of mobile RASP, and NonaShield includes it as the first of nine layers. Read the overlay attack guide for the detail.
Frequently asked questions
What is a mobile banking trojan?
Malware designed to steal from banking apps by reading screens, overlaying fake login pages, intercepting one-time passwords and performing taps on the victim's phone.
Why do banking trojans want accessibility permission?
It lets the app read what is on screen and tap on the user's behalf, which is exactly what the attacker needs to run a session invisibly.
Can an app block accessibility abuse?
It can detect untrusted accessibility services and overlays while it is in the foreground and refuse to continue, or step up the session.
Does NonaShield detect banking trojans?
It detects the runtime behaviours they depend on, such as overlays, accessibility abuse, hooking and screen sharing, rather than relying on a list of known malware.
See it on your app.
Book a free 30-day shadow pilot, or download the platform brochure.