Report: in 2018, 889K+ users were attacked with banking Trojans, up ~16% YoY, while Android banking malware attacked ~1.8M users, up 300%+ YoY
Context & Ripple Effects
Mobile malware has been compounding for years — Kaspersky counted a 25% rise in infections across ~16M devices back in 2014, and its own telemetry showed Android ransomware nearly quadrupling month-over-month by April 2016 (136K customers hit). The 2018 numbers mark the point where that growth concentrated on money: banking-specific attacks are no longer a side category but the fastest-growing segment.
The asymmetry matters more than either figure alone. Desktop banking Trojans grew a steady ~16%, while Android banking malware tripled-plus in a single year — consistent with the earlier pattern of criminal groups like the ones behind the $300M bank-institution heists following account holders onto whatever device they actually bank from.
First-order effects
- Roughly 1.8M Android users entered 2019 having had banking credentials or payment data targeted, and banks whose apps those credentials unlock inherit the fraud losses and customer-support burden immediately.
Second-order effects
- Financial institutions are pushed to harden mobile channels — device attestation, in-app behavioral checks — because the attack surface has moved off the PC, where the ~16% Trojan growth shows the older playbook still works but scales slower.
Third-order effects
- If the 300% trajectory reflects banking permanently shifting to phones, mobile becomes the primary battleground for financial malware — a path later borne out by campaigns like Drinik impersonating India's tax app across 18 banks — and puts sustained pressure on Google to treat banking-app integrity as a platform-security obligation rather than an app-vendor problem.
The trend: Financial malware is migrating from desktops to Android as banking itself goes mobile, with attack volumes tracking where the accounts live.