Invest Not yet confirmed elsewhere 1 publisher2 min readPublished Aug 27, 2026, 4:22 AM PDT

Georgia Tech found malware could move money unassisted in 35 of 159 banking apps it tested

The Georgia Tech corpus says the handset belongs to the attacker while Regulation E says the loss belongs to the bank, which makes every extra authentication factor pushed to that same phone a purchase with no yield.

The Investor · Invest desk

How we use AI Send a correction

Illustration accompanying Georgia Tech found malware could move money unassisted in 35 of 159 banking apps it tested — Generated illustration

What happened

Georgia Tech researchers ran 9,850 malware samples pulled from VirusTotal on Android phones and found banking the largest of seven target categories, with 159 apps hit by 3,579 samples.
In 35 of those 159 apps, all of them banks' own software rather than counterfeits, the malware could initiate a money transfer with no action at all from the customer.
Of the 9,850 samples, 9,102 blocked the user from revoking the malware's permissions and 9,024 blocked uninstallation, putting removal beyond ordinary customer means.
In 98 of the 159 banking apps, the malware hid or deleted the notifications a bank sends when it spots something wrong on the phone or in the account.
Zimperium research released this week counts more banking apps under active targeting in the United States than in any other country.

Why it matters

constraint If a compromised handset exposes every factor delivered to it, the cheapest upgrade on most fraud roadmaps, one more code or approval sent to that phone, stops adding measurable protection.
cost Regulation E routes most of what the malware takes onto the bank's own books, so the paying party is the one with no control over the handset or the accessibility setting the attack rides.
decision The bank's cheapest support script, telling the customer to delete the app, is no longer available, which pushes remediation into channels the bank neither owns nor prices.
exposure ThreatFabric's rising count of small and midsize U.S. banks and credit unions on target lists means the same Regulation E liability now reaches institutions that were previously below the attackers' economic threshold.

The split inside that 159 is where the underwriting sits. The samples were built to harvest credentials from 147 of the apps ^[9], and stolen credentials still have to be spent somewhere, which leaves the bank's server-side scoring one more look at the transaction; for 112 apps that second look is the entire defense ^[22]. In the other 35 the transfer starts on the customer's own handset inside the customer's own session, 22% of the tested set ^[21], and there is no login anomaly to catch because nothing anomalous happened at login.

Android's accessibility service, built so software can read the screen and tap on a user's behalf for people with disabilities, is what makes most of this work ^[11], and the same access covers the channels banks use to check their work: SMS passcodes, email, push notifications and in-app approvals are all readable and editable once the device is taken over ^[3]. Eward Driehuis of ThreatFabric puts it as an engineering constraint rather than a warning, saying multifactor authentication becomes "less efficient or even fully compromised if additional factors are available from the same device" ^[2]. Read that as a budget line. A dollar spent adding a fourth on-device factor is a dollar not spent on an off-device factor or on server-side behavioural scoring, and on this evidence only the second pair is still standing.

The most useful number here is one nobody has. Singapore, Malaysia, India and Hong Kong already require protections inside the banking app ^[17], and Driehuis says ThreatFabric's intelligence "does not show a significant decrease in mobile malware activity" in those regions ^[4]. This is probably too harsh a reading of one vendor's telemetry, and ThreatFabric sells fraud-detection software ^[19], so its account of its own data is not disinterested. But four mandates with no measurable decline is the nearest thing to a controlled test anyone has run on app hardening, and it suggests hardening is a compliance cost that does not price as a control.

The evidence has dated edges. The sample window closed in December 2022 ^[5], so anything Android has tightened since is invisible in these percentages. Zimperium's count of the U.S. leading the world in banking apps under active targeting arrives without an absolute number attached ^[1]. And the 54% of customers who now bank primarily by app, per Morning Consult ^[15], is a mobile-first population that includes iPhones, while the corpus is Android.

Which leaves 35 of 159. Nothing in the source material argues with it.

What to watch

A refreshed run of the Georgia Tech corpus against current Android builds, which would show whether accessibility abuse still yields unassisted transfers.
Whether U.S. regulators copy the in-app protection mandates already live in Singapore, Malaysia, India and Hong Kong.
The first Regulation E dispute in which a bank argues an unanswered fraud alert as evidence of customer consent.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence72
Adoption68
Hype gap+12
Incentives66
Confidence60

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
Research released this week by mobile security vendor Zimperium counts more banking apps under active targeting in the U.S. than in any other country.
ReportedSupported2 sources— create a free account to open them View cited source
[2]
Eward Driehuis, vice president of fraud engineering at ThreatFabric, said most such malware is "actually taking over the device" and that malware makes multifactor authentication "less efficient or even fully compromised if additional factors are available from the same device."
ReportedSupportedSource: Eward Driehuis, ThreatFabric, to American Banker2 sources— create a free account to open them View cited source
[3]
Malware on a compromised phone can see and manipulate text messages carrying one-time passcodes, emails, push notifications and in-app transaction approvals.
ReportedSupported2 sources— create a free account to open them View cited source
[4]
Driehuis said ThreatFabric's intelligence "does not show a significant decrease in mobile malware activity" in those regions.
ReportedSupportedSource: Eward Driehuis, ThreatFabric2 sources— create a free account to open them View cited source
[5]
A group led by Brendan Saltaformaggio, an associate professor at Georgia Tech, collected malware samples from VirusTotal between August and December 2022 and ran them on Android phones.
ReportedSupportedView cited source
[6]
Saltaformaggio's team studied 9,850 malware samples.
ReportedSupportedView cited source
[7]
The group sorted targeted apps into seven categories; banking was the largest, with 159 apps targeted by 3,579 malware samples.
ReportedSupportedView cited source
[8]
The 159 apps were banks' own apps, not counterfeits, and the five countries where they were most widely used were Russia, Brazil, the United Kingdom, the United States and Mexico.
ReportedSupportedView cited source
[9]
The studied malware was designed to collect credentials such as usernames and passwords from 147 of the 159 banking apps.
ReportedSupportedView cited source
[10]
For 35 of the 159 banking apps, the malware could initiate a money transfer without the customer doing anything.
ReportedSupportedView cited source
[11]
Android's accessibility service, which lets software read the screen and tap on a user's behalf so people with disabilities can operate a phone, makes much of this possible.
ReportedSupportedView cited source
[12]
Of the 9,850 samples, 9,102 blocked the user from revoking the malware's permissions and 9,024 blocked the user from uninstalling it, making more than 90% unremovable by normal means.
ReportedSupportedView cited source
[13]
In 98 of the 159 banking apps, the malware either hid or deleted the notifications a bank sends when it sees something wrong on the customer's phone or in their banking activity.
ReportedSupportedView cited source
[14]
Saltaformaggio told American Banker that because malware can dismiss fraud alerts, "banks must not assume that an ignored warning implies the customer was okay with a transaction."
ReportedSupportedSource: Brendan Saltaformaggio, Georgia Tech, to American BankerView cited source
[15]
More than half of bank customers, 54%, now manage their accounts primarily through a mobile app, according to Morning Consult.
ReportedSupportedSource: Morning ConsultView cited source
[16]
Regulation E turns most of the malware's gains into banks' losses.
ReportedSupportedView cited source
[17]
Regulators in Singapore, Malaysia, India and Hong Kong require protections inside the banking app itself.
ReportedSupportedView cited source
[18]
ThreatFabric reports that attackers are adding small and midsize U.S. banks and credit unions to their target lists, and that the count is rising.
ReportedSupportedSource: ThreatFabricView cited source
[19]
ThreatFabric is an Amsterdam mobile threat intelligence firm that sells fraud-detection software.
ReportedSupportedView cited source
[20]
Telling customers to delete the app does not work as a remedy for this malware.
ReportedSupportedView cited source
[21]
The 35 apps in which malware could move money unassisted are 22% of the 159 banking apps targeted.
DerivedSupported1 source— create a free account to open them
[22]
For 112 of the targeted banking apps, the malware harvested credentials but could not initiate a transfer on its own.
DerivedSupported1 source— create a free account to open them

Sources

1 independent publisher whose own reporting we read for this story.

americanbanker.com
1 article · August 27, 2026
U.S. bank apps are now top target for malware: Study

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder

For anyone building a mobile banking or payments app, the operative finding is architectural: Android's accessibility service lets malware read the screen and tap on the user's behalf, which is how 3,579 samples reached 159 genuine bank apps, harvested credentials in 147 of them and initiated transfers unassisted in 35. Device-resident second factors - SMS codes, push approvals, in-app confirmations - are observable and manipulable from the same compromised handset. The one publisher in this cluster also reports that jurisdictions mandating in-app hardening saw no significant decline in activity per ThreatFabric, and that attackers moved to contactless-relay techniques that never touch the bank app, which argues for out-of-band and server-side signals over app-shell defenses. No platform-vendor response or paper-level methodology detail is present.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence72: 0100
Quantified academic corpus, reported at one remove
The core findings are unusually specific and internally consistent: a named researcher, a defined collection window, 9,850 executed samples, and per-app counts (159 targeted, 147 credential-harvesting, 35 unassisted transfer, 98 alert-suppressing, 9,102/9,024 persistence). Liability claims are grounded in cited CFPB Regulation E FAQ material. Deductions: the cluster contains only one publication, the underlying paper is not quoted or linked in the supplied text, the corpus dates from 2022 while the targeting counts are 2026, and the trend assertions rest on two commercial vendors' private telemetry rather than reproducible data.
Adoption68: 0100
Widely deployed attack surface, real channel scale
Adoption here is the real-world footprint of the phenomenon rather than of a product, and it is measured on both sides: thousands of live samples targeting 159 genuine bank apps in the corpus, 162 U.S. apps under active targeting per Zimperium versus 69 in the UK, and 54% of bank customers primarily using mobile apps. The expansion into small and midsize U.S. institutions is asserted directionally without absolute counts, and no data quantifies how many customers or transfers are actually affected, so this is short of fully measured deployment.
Hype gap+12: −100 understated0 aligned+100 overstated
Slightly overstated by headline generalization
Findings and framing are mostly proportionate - the article discloses that Zimperium's U.S. lead partly reflects the sheer number of U.S. institutions and states outright that no public dataset separates malware-driven transfers, leaving total exposure unmeasured. The mild overstatement is temporal and rhetorical: a 2022 sample corpus is presented as the current state of 'U.S. bank apps are now top target', the 35-of-159 capability is a laboratory capability rather than an observed loss volume, and the two corroborating trend sources both sell fraud-detection products. No claim in the cluster is contradicted by another supplied source.
Incentives66: 0100
Vendor-supplied trend data, disclosed
The two sources carrying the forward-looking claims are commercially interested: ThreatFabric sells fraud-detection software and supplies the MFA-compromise, hardening-ineffectiveness and target-expansion assertions, while Zimperium is a mobile security vendor whose report supplies the U.S.-is-top-target count. Both have a direct interest in banks perceiving device-side controls as insufficient. Mitigating factors: the article discloses ThreatFabric's business model, the quantitative core comes from an academic team with different incentives, and the liability analysis rests on regulator documents.
Confidence60: 0100
Specific but single-publisher
Confidence is limited chiefly by cluster structure: one publisher, one source item, no independent reporting to cross-check the corpus counts, the vendor telemetry or the Regulation E reading. Within that constraint the material is highly specific, attributed to named individuals and documents, and the article flags its own measurement gap, which supports moderate rather than low confidence.

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Commercial threat intelligenceFollow
In-app security mandatesFollow
Limits of device-bound MFAFollow
Android platform securityFollow
Mobile Banking MalwareFollow
Regulation E fraud liabilityFollow

Entities

Georgia Institute of Technology Follow
Brendan SaltaformaggioFollow
ThreatFabric Follow
Eward DriehuisFollow
Zimperium Follow
VirusTotal Follow
Android Follow
Android Accessibility ServiceFollow
Regulation EFollow
Federal Financial Institutions Examination Council Follow
Morning Consult Follow
American Banker Follow
Consumer Financial Protection Bureau Follow