Banking Trojans With Stealer Capability: The Malware That Shaped Modern Financial Cybercrime

Banking trojans are one of the most important malware categories in cybercrime history. Before today’s large-scale infostealer economy, banking trojans built the model for stealing credentials, manipulating browser sessions, intercepting financial activity, and turning infected machines into fraud infrastructure. They started with a clear goal: steal online banking credentials and move money. Over time, many evolved into modular botnets, access-broker tools, ransomware delivery platforms, and general-purpose credential theft systems.

This group is different from Windows commodity stealers, macOS stealers, and Android banking trojans. Windows commodity stealers usually focus on collecting browser data, cookies, passwords, wallets, files, and application secrets as quickly as possible. Banking trojans focus on financial account compromise and transaction fraud. They often include capabilities such as webinjects, form grabbing, man-in-the-browser attacks, keylogging, screenshots, browser redirection, credential harvesting, and botnet control.

The most important banking trojans also became bridges between old-school bank fraud and modern enterprise intrusion. Zeus, SpyEye, Citadel, Gozi, Dridex, TrickBot, QakBot, IcedID, Ramnit, Tinba, Dyre, Carberp, Shylock, Vawtrak, Kronos, Panda Banker, and DanaBot all helped shape the way criminals steal credentials, manage infected machines, and monetize access. Some of these families are historical. Some are disrupted. Some evolved into loaders. Some continue to influence malware development today.

CISA describes TrickBot as malware first identified in 2016 and originally designed as a banking trojan to steal financial data. Through continued development, TrickBot became a highly modular, multi-stage malware platform used for many types of cybercrime. CISA describes QakBot in a similar way: it began as a banking trojan and evolved into a multipurpose botnet capable of reconnaissance, lateral movement, data exfiltration, and ransomware delivery. This evolution explains why banking trojans still matter. They are not only historical bank-fraud tools. They are part of the foundation of today’s ransomware, credential theft, and initial-access ecosystem.

What makes banking trojans different

Banking trojans were built to steal money from financial accounts. That goal shaped their techniques. Instead of only collecting saved browser passwords, many banking trojans watched the user interact with online banking sites. They could capture login forms, inject fake fields into bank pages, redirect the victim to attacker-controlled pages, modify transactions, and hide fraudulent activity from the user. This made them more interactive and more fraud-oriented than classic password stealers.

The defining technique is the webinject. A webinject modifies what the victim sees in the browser when visiting a targeted site. The bank’s page may look normal, but malicious code is added into the session. The injected content may ask for extra credentials, card details, one-time codes, security questions, or personal identity information. In some campaigns, webinjects also helped attackers manipulate payments or create fraudulent transfer workflows.

Another important technique is man-in-the-browser. In this model, the malware operates inside or alongside the victim’s browser session. It can observe what the user types, capture credentials before encryption, alter displayed content, and interact with banking sites in real time. Zeus became famous for this style of browser-based banking fraud. MITRE describes Zeus Panda as a trojan designed to steal banking information and other sensitive credentials, and notes that leaked Zeus source code allowed other threat actors to build new variants.

Banking trojans also relied heavily on botnet control. An infected device was not only a source of credentials. It was part of a managed network of machines. Operators could push modules, update configurations, change target lists, deliver additional malware, collect logs, and use compromised machines for fraud. This botnet architecture influenced later malware-as-a-service models, loader operations, and access-broker markets.

The evolution from banking fraud to enterprise intrusion

The early banking trojan economy focused on financial institutions and consumer banking. Criminals wanted bank logins, payment card data, security codes, and the ability to move funds. Over time, the same techniques became useful for broader cybercrime. If malware can steal bank credentials, it can also steal corporate email credentials, VPN credentials, cloud credentials, payroll credentials, and SaaS access. If malware can manage infected machines as a botnet, it can also deliver ransomware, proxy traffic, and additional payloads.

This is the key reason banking trojans belong in an infostealer series. They were not always marketed as “infostealers,” but stealing credentials and sensitive data was central to their value. Dridex is a strong example. MITRE describes Dridex as a prolific banking trojan that first appeared in 2014, and states that the U.S. Treasury estimated by December 2019 that Dridex had infected computers across hundreds of banks and financial institutions in over 40 countries, leading to more than $100 million in theft.

QakBot is another clear example. Europol stated that QakBot targeted critical infrastructure and businesses across multiple countries, stealing financial data and login credentials, and that cybercriminals used it for ransomware, fraud, and other cyber-enabled crimes. The shift from financial credential theft to ransomware support is one of the most important developments in malware history. It shows how banking trojans became infrastructure for broader criminal operations.

IcedID followed a similar path. IBM X-Force researchers discovered IcedID in 2017, and IBM reported that it targeted banks, payment card providers, mobile service providers, payroll, webmail, and e-commerce sites, mainly in the United States. MITRE also tracks IcedID as a banking trojan associated with ransomware-related intrusion activity. These families show that the line between banker, stealer, loader, and initial-access malware became increasingly thin.

Major banking trojan families with stealer capability

Zeus, also known as Zbot, is the most influential banking trojan family in cybercrime history. It popularized man-in-the-browser banking theft, credential harvesting, form grabbing, and botnet-based financial fraud. Zeus became even more influential after its source code leaked in 2011, enabling other criminals to build variants and derivative malware. MITRE notes that Zeus Panda’s source code leak allowed threat actors to use it as a basis for new variants. Zeus matters because many later banking trojans inherited its ideas: browser manipulation, credential theft, modular botnet control, target configuration files, and underground service models.

SpyEye was one of Zeus’s major competitors and successors in the early banking trojan era. It was designed for online banking fraud, credential theft, and botnet control. SpyEye became known for its rivalry with Zeus and later consolidation in the underground banking trojan market. Its importance is historical, but its influence remains visible in the way later banking trojans combined credential theft, browser manipulation, and criminal service infrastructure.

Citadel was a Zeus-derived banking trojan that added commercial polish to the Zeus model. It used a criminal software product approach, with feature updates, customer-style support, and configuration flexibility. Citadel is important because it showed how banking trojans could be packaged and sold in a way that resembles modern malware-as-a-service. It helped move cybercrime from individual malware builds toward more organized criminal software ecosystems.

Gozi, also known through the Ursnif and ISFB lineage, is another major family. MITRE describes Ursnif as a banking trojan and variant of Gozi that spread through exploit kits, spearphishing attachments, and malicious links, and states that Ursnif is primarily associated with data theft while some variants include backdoors, spyware, and file injectors. Trend Micro states that Ursnif, also known as Gozi, is one of the most widely spread banking trojans, and that its leaked source code enabled other malware authors to add new features and continue development. Gozi’s long life shows how leaked code and modular development can keep a banking trojan lineage relevant for many years.

Dridex emerged from the Bugat and Cridex lineage and became one of the most damaging banking trojans of the 2010s. It targeted financial institutions, harvested credentials, and operated through large-scale phishing campaigns. Dridex also became connected to ransomware ecosystems and broader enterprise compromise. Its importance comes from both financial theft and the way it helped normalize malware operations that combine phishing, credential theft, botnet management, and follow-on payload delivery.

TrickBot started as a banking trojan and evolved into one of the most important modular malware platforms of the late 2010s and early 2020s. CISA states that TrickBot was originally designed to steal financial data, then expanded into a highly modular, multi-stage malware suite used against individuals and businesses globally. TrickBot’s modules enabled credential theft, reconnaissance, lateral movement, persistence, and payload delivery. Its connection to ransomware operations made it a core part of enterprise cybercrime.

QakBot, also known as Qbot or Pinkslipbot, followed a similar path. It began as a banking trojan and later became a multipurpose malware platform. CISA states that QakBot evolved from a banking trojan into a botnet and malware variant with capabilities including reconnaissance, lateral movement, data exfiltration, and ransomware delivery. Europol’s 2023 operation against QakBot highlighted its role in credential theft, financial data theft, ransomware, and fraud. QakBot is one of the clearest examples of the banking trojan to ransomware-enabler evolution.

IcedID, also called BokBot, was first discovered by IBM X-Force in 2017. IBM reported that it originally targeted banks, payment cards, mobile service providers, payroll, webmail, and e-commerce sites. IcedID later became important as an initial-access and malware-delivery platform. This evolution shows the same market logic seen with TrickBot and QakBot: financial theft remains valuable, but access to corporate environments can be even more valuable.

Ramnit began as a file-infecting worm and evolved into a modular banking trojan. ANY.RUN describes Ramnit as a highly modular banking trojan and worm that specializes in financial fraud, credential theft, remote access, and malware delivery. Ramnit is important because it combines worm-like propagation, banking theft, and modular criminal functionality. Its hybrid nature makes it useful for both financial fraud and broader compromise.

Tinba, also known as Tiny Banker, became known for its small size and banking focus. Imperva describes Tiny Banker Trojan, or Tinba, as malware that infects end-user devices and attempts to compromise financial accounts and steal funds, and states that it was first discovered in 2012. Tinba shows that banking trojans do not need to be large to be effective. Small, focused malware can still perform high-impact browser and credential theft.

Dyre, also known as Dyreza, became a major banking trojan in the mid-2010s. It targeted online banking and corporate credentials, often through phishing campaigns and man-in-the-browser techniques. Dyre is important because it showed how banking trojans could target businesses, treasury accounts, and high-value corporate banking workflows. Its operators focused on financial theft at scale, including business banking targets.

Carberp was another influential banking trojan family. It targeted financial credentials, used webinjects, and became known for both technical sophistication and underground circulation. Carberp’s history is also linked to source-code leaks and reuse, which helped spread techniques into other malware.

Shylock was a banking trojan focused on online banking fraud, webinjects, and credential theft. It was part of the same generation of browser-manipulating bankers that targeted financial institutions and consumers. Its importance is mainly historical, but it represents the era when webinject-driven bank fraud was one of the highest-value cybercrime models.

Vawtrak, also known as Neverquest, targeted banking credentials and other sensitive data. It used webinjects, form grabbing, and botnet control, and was associated with online banking fraud campaigns. Vawtrak shows how banking trojan operators refined credential theft and fraud tooling for specific financial targets.

Kronos was a banking trojan associated with form grabbing, webinjects, and credential theft. It gained attention because of its place in the banking trojan market and its reported reuse or evolution in later malware. Kronos matters as part of the broader family of Zeus-era descendants and contemporaries that competed in the underground financial malware market.

Panda Banker, also known as Zeus Panda, is a Zeus-derived banking trojan. MITRE describes Zeus Panda as designed to steal banking information and sensitive credentials, mainly targeting Windows systems. Panda Banker is important because it shows the long life of Zeus-derived ideas and the way old codebases can support new campaigns.

DanaBot is a more recent banking trojan that combines modular design, credential theft, banking fraud, and malware delivery. It has appeared in campaigns targeting financial data and personal information, and public reporting has described its reemergence after disruption activity. As a modern banker, DanaBot shows that the category continues to evolve even as pure commodity stealers dominate many credential theft conversations.

Comparison table: major banking trojans with stealer capability

This table compares the families by operational role rather than strict technical lineage. That is the most useful approach for a business and security audience because many banking trojans changed over time. A family could begin as a bank-fraud tool, add credential theft, add modules, become a loader, and eventually serve ransomware or access-broker operations.

How banking trojans steal credentials

Banking trojans use several overlapping techniques to steal data. Form grabbing captures information entered into web forms before it is encrypted and sent to the legitimate site. This allows attackers to collect usernames, passwords, card numbers, security answers, and one-time codes as the victim types them.

Keylogging records keystrokes across applications and browsers. It is less precise than form grabbing, but it can capture credentials from many environments. Some banking trojans combine keylogging with screenshots, window titles, clipboard capture, and browser monitoring to create a complete picture of the victim’s activity.

Webinjects are more targeted. They modify a banking or payment page in the victim’s browser. The injected content may ask for additional verification, display fake error messages, collect extra details, or manipulate the transaction flow. This technique is especially effective because the victim is already on the real bank’s site and expects security prompts.

Browser redirection sends the victim to an attacker-controlled page that looks like a legitimate bank page. Some trojans use redirection to steal credentials, while others use it to hide fraudulent activity or force the victim through a fake verification process.

Credential dumping and application theft became more important as banking trojans evolved. Modern variants and modules can steal email credentials, FTP credentials, browser passwords, VPN access, cookies, certificates, and enterprise secrets. This helped banking trojans move beyond bank fraud and into broader access theft.

The role of webinjects

Webinjects are the signature capability of the banking trojan era. They turned malware into a real-time fraud tool. Instead of waiting for the victim to save a password or reuse a credential, the malware could interact with a live banking session. The attacker could request additional information, alter what the victim saw, and tailor attacks to specific banks.

Webinjects also created a service economy. Criminals could build and sell inject packages for specific banks, countries, and financial institutions. This allowed malware operators to expand targeting without rewriting the entire malware family. A banking trojan with flexible webinject support could be adapted to new banks and regions through configuration updates.

This model influenced modern malware configuration systems. Today’s stealers and mobile bankers still rely on target lists, dynamic configurations, and modular updates. The idea is the same: keep the malware core stable while changing targets, collection rules, infrastructure, and monetization paths.

From botnets to ransomware delivery

The biggest change in banking trojans was the shift from direct financial theft to enterprise access monetization. Bank fraud remained valuable, but corporate network access became even more valuable. A botnet with infected business machines could deliver ransomware, steal data, map networks, harvest domain credentials, and sell access to other criminal groups.

TrickBot and QakBot are the best examples of this transition. TrickBot began as a banking trojan and became a modular malware platform. CISA’s description emphasizes its evolution from financial theft to a suite of tools used for many illegal cyber activities. QakBot began as a banking trojan and evolved into a botnet used for reconnaissance, lateral movement, exfiltration, and ransomware delivery.

This evolution changed incident response. A banking trojan infection on a corporate machine should be treated as a potential enterprise intrusion, not only as financial malware. The malware may have harvested credentials, moved laterally, deployed additional payloads, created persistence, or opened the door to ransomware affiliates.

Business impact

The business impact of banking trojans depends on the family, victim role, and environment. For individuals, the main risks are bank fraud, card theft, account takeover, identity theft, and unauthorized transfers. For businesses, the risks include payroll theft, supplier payment fraud, business email compromise, credential exposure, ransomware, cloud compromise, and data theft.

Corporate banking users are especially valuable. Treasury teams, finance teams, payroll staff, executives, and administrators often have access to payment systems and sensitive accounts. A banking trojan that captures their credentials can support wire fraud, payroll diversion, supplier invoice manipulation, and unauthorized transfers.

Enterprise identity exposure is equally important. A banking trojan that steals email, VPN, SSO, or domain credentials can become the first step in a larger intrusion. Once inside, attackers can expand access, steal data, deploy additional tools, and sell the access. This is why historical banking trojans remain relevant to modern security strategy.

Detection opportunities

Banking trojan detection should focus on both malware behavior and identity misuse. On the endpoint, defenders should look for suspicious browser injection behavior, credential store access, keylogging indicators, screenshot capture, unexpected modules, suspicious persistence, and network connections to known or suspicious command-and-control infrastructure.

Email telemetry remains important because many banking trojans spread through phishing attachments, malicious links, password-protected archives, document macros, scripts, and downloader chains. Families such as Dridex, IcedID, QakBot, TrickBot, Ursnif, and Agent-style loaders have long used email-driven delivery or malware-delivery partners.

Network monitoring should look for beaconing behavior, unusual encrypted traffic patterns, connections to newly registered domains, botnet command infrastructure, and payload staging. Many banking trojans use fast-changing infrastructure, so behavior and threat-intelligence enrichment should work together.

Identity monitoring is essential. Security teams should watch for unusual logins, new devices, impossible travel, VPN anomalies, mailbox rule creation, suspicious payroll changes, new bank beneficiaries, unusual payment workflows, and high-risk administrative activity. Banking trojan infections often become visible through account behavior before the malware itself is fully understood.

Prevention priorities

The strongest defense combines endpoint protection, email security, browser hardening, identity controls, and financial-process controls. Endpoint detection should cover credential theft, browser manipulation, suspicious script execution, persistence, and malware delivery chains. Email controls should reduce phishing delivery, block dangerous attachment types, scan URLs, and detonate suspicious documents and archives.

Identity controls reduce the value of stolen credentials. Phishing-resistant MFA, conditional access, device trust, session monitoring, and rapid token revocation make it harder for attackers to use stolen credentials at scale. Session and cookie theft should be part of the defensive model because password resets alone may leave active sessions exposed.

Financial controls are also critical. Transaction approval workflows, out-of-band verification, beneficiary change controls, payment anomaly detection, and dual approval can limit the damage from stolen banking credentials. Banking trojans are designed to exploit trust in normal financial workflows, so organizations need controls that verify the transaction, not only the login.

Patch management and least privilege reduce exploit and lateral-movement opportunities. While many banking trojans arrive through phishing, their enterprise impact often depends on privilege, unpatched systems, weak internal segmentation, and reusable credentials.

Response and remediation

A banking trojan infection should trigger both malware response and credential response. The endpoint should be isolated, investigated, and cleaned or rebuilt depending on severity. Security teams should identify the malware family, understand the timeline, review persistence, and look for additional payloads.

Credential remediation should include password resets, session revocation, token rotation, VPN credential review, email account review, and financial account checks. For business users, teams should review payroll systems, payment platforms, banking portals, supplier records, mailbox rules, forwarding settings, and recent transactions.

When the malware family is associated with loaders or ransomware delivery, response should expand to the network level. TrickBot, QakBot, IcedID, Dridex, and similar families deserve wider investigation because they may indicate broader compromise. Teams should look for lateral movement, additional malware, credential dumping, remote access tools, suspicious admin activity, and signs of ransomware staging.

Comparison framework for banking trojans

The best way to compare banking trojans is to score them by financial fraud capability, credential theft scope, modularity, botnet control, enterprise impact, and ransomware enablement.

This framework makes it easier to compare Zeus with TrickBot, or Tinba with QakBot. Zeus and Tinba are critical to the history of banking theft. TrickBot and QakBot are critical to the evolution of enterprise intrusion. They all belong in the same group, but they represent different stages of the banking trojan lifecycle.

How banking trojans fit into the infostealer economy

Banking trojans created many of the ideas that modern infostealers use today. They normalized credential theft at scale. They built markets for logs and access. They used configurable target lists. They relied on criminal software support models. They showed the value of botnets. They proved that stolen credentials could support many downstream crimes beyond direct bank fraud.

Modern commodity infostealers focus more heavily on browser sessions, cookies, crypto wallets, SaaS credentials, and developer secrets. Mobile banking trojans focus on overlays, SMS interception, Accessibility abuse, and on-device fraud. Banking trojans sit between these worlds. They are the historical and technical bridge between credential theft and transaction fraud, between personal banking theft and enterprise ransomware, and between malware infection and access monetization.

For a blog series on infostealer groups, banking trojans provide the origin story. They explain how cybercrime moved from stealing passwords to manipulating sessions, from stealing money to selling access, and from single-purpose malware to modular criminal platforms.

Conclusion

Banking trojans with stealer capability are one of the most influential malware groups in cybercrime history. Zeus, SpyEye, Citadel, Gozi, Dridex, TrickBot, QakBot, IcedID, Ramnit, Tinba, Dyre, Carberp, Vawtrak, Kronos, Panda Banker, and DanaBot shaped how criminals steal credentials, manipulate financial sessions, manage botnets, and monetize infected machines.

Their legacy is visible everywhere in the modern threat landscape. Webinjects influenced mobile overlays. Botnet management influenced malware-as-a-service. Credential theft enabled access brokers. Modular banking trojans became ransomware delivery platforms. The same criminal logic remains: steal identity data, use it for fraud, or sell it to someone who can.

For defenders, the most important lesson is that a banking trojan infection is both a financial fraud incident and an enterprise security incident. The response should cover malware removal, credential rotation, session revocation, payment review, mailbox review, lateral-movement investigation, and ransomware risk assessment. Banking trojans began as tools for stealing from bank accounts, but their impact now reaches identity systems, cloud platforms, corporate networks, and the broader cybercrime economy.