Banking trojans are among the most methodical and persistent threats in the cybercriminal ecosystem. They are not opportunistic nuisances — they follow a structured lifecycle, operated by organized groups that have gradually industrialized their craft to the point of offering their tools as a service. Understanding how that lifecycle works is the first step toward disrupting it.
Infection vectors: it starts with a single click
In the vast majority of cases, infection begins with a phishing email. The message either carries a malicious attachment — a macro-laced Office document, a compressed archive — or a link pointing to an attacker-controlled download page. Email remains the preferred entry point because it bypasses many network controls and relies on human behavior rather than technical exploits.
Some campaigns also leverage malvertising or compromised legitimate websites. In a typical scenario, an employee at a small business receives what looks like a supplier invoice in Word format. Enabling macros to "view the document" silently triggers the download of a loader — a lightweight component whose only job is to fetch the actual payload from a remote server.
Persistence: settling in for the long haul
Once a machine is compromised, the trojan's priority is survival. Persistence is typically achieved through native Windows mechanisms: registry keys (commonly under HKCU\Software\Microsoft\Windows\CurrentVersion\Run), scheduled tasks, or injection into legitimate processes to blend in with normal system activity.
More sophisticated variants layer multiple redundant persistence methods to ensure they survive reboots and basic cleanup attempts. The goal is to stay undetected for as long as possible — sometimes weeks or months — before the exfiltration phase becomes active.
C2 communication: the invisible command line
The command-and-control (C2) channel is the nervous system of a banking trojan. Through it, attackers issue instructions, receive stolen data, and push updates to the malware remotely. Early generations relied on hardcoded IP addresses or plaintext registered domains — effective but easy to block once identified.
Modern families have moved toward far more resilient techniques: domain generation algorithms (DGAs) that automatically produce thousands of potential domain names, communication tunneled through legitimate cloud services or social platforms, and encrypted protocols designed to hide malicious traffic inside ordinary HTTPS flows. Detecting this kind of traffic requires behavioral analysis capabilities and a solid understanding of what normal network communication looks like on a given environment.
Exfiltration: where the money is made
Exfiltration in the banking trojan context is nothing like bulk file theft. It is targeted, often real-time, and surgical. The most common mechanisms include form grabbing — capturing credentials entered into web forms before the browser encrypts them — web injection to silently modify banking pages displayed to the victim, and keylogging.
Collected data — login credentials, card numbers, one-time passwords — is typically sent to the C2 in small batches to minimize detection. Some variants remain dormant until they detect a visit to a targeted banking site, activating only when the payoff is at its highest.
Zeus, Emotet, TrickBot, Qakbot: a criminal family tree
Zeus, which emerged around 2007, established the template for the genre. Its source code, leaked in 2011, became the foundation for dozens of derivatives. It combined form grabbing with encrypted C2 communication and focused primarily on Western financial institutions.
Emotet started as a conventional banking trojan before pivoting into a universal loader. Its defining characteristic was aggressive lateral movement across local networks, turning each infected machine into a potential delivery vehicle for its neighbors. It eventually became one of the most feared malware distribution infrastructures in existence — rented out to other criminal groups.
TrickBot, which appeared in 2016, embraced a modular architecture. Each capability — credential theft, lateral movement, network reconnaissance — is packaged as a separate, downloadable module. This design made updates easier to push and forensic analysis significantly harder.
Qakbot (also known as QBot) followed a similar trajectory, showing remarkable resilience despite multiple partial takedowns. Its longevity stems partly from a distributed C2 infrastructure and an ability to reconstitute quickly after disruption.
Malware-as-a-Service: organized crime goes subscription
The most consequential shift of the past decade is the rise of the Malware-as-a-Service (MaaS) model. Operators of a malicious infrastructure lease access to other criminal groups, in much the same way a SaaS vendor sells subscriptions. Customers — referred to as affiliates — get a management interface, sometimes responsive technical support, and regular feature updates.
This model has two major consequences for defenders. First, it dramatically lowers the technical barrier to running a campaign: affiliates don't need to understand the code, only to deploy it. Second, it complicates attribution, since the same tooling can be used by dozens of groups with different targets and motives.
For businesses across Morocco and sub-Saharan Africa connected to international banking systems, this means campaigns that were once confined to Western markets can now be redeployed locally at minimal cost by any actor with a modest budget and access to the right forums.
Frequently asked questions
What is the difference between a banking trojan and ransomware?
A banking trojan is designed to steal credentials and initiate fraudulent transactions while remaining as invisible as possible. Ransomware announces itself explicitly to demand payment. The two are not mutually exclusive: Emotet and TrickBot have both been used as delivery mechanisms for ransomware in a second stage of attack.
How can a SOC team detect an active banking trojan on the network?
The most useful signals are abnormal outbound connections to recently registered or low-reputation domains, system processes initiating unusual network activity, and process injection behavior. Behavioral analysis and log correlation across EDR, proxy, and DNS sources consistently outperform static antivirus signatures against modern variants.
Does the MaaS model affect companies outside the banking sector?
Absolutely. Despite their name, modern banking trojans harvest any credential with value: VPN access, HR portals, corporate email accounts. An MaaS affiliate can target any sector based on the perceived market value of the access being sold on underground forums.
Was Qakbot permanently dismantled?
Qakbot's infrastructure was the target of a coordinated takedown operation in 2023. History in this space, however, shows that the groups behind these tools tend to regroup or migrate to new infrastructure. Dismantling an operation does not mean eliminating the actors or the codebase they built on.