A banker trojan targets online banking by pretending to be useful software, then stealing credentials or interfering with a payment the person meant to approve.
It is a disguise problem first, which separates it from a virus that must attach to a host file before it can travel.
How it works
The harm shows up as unauthorized transfers, changed payees, or extra fields inserted into a banking session that still looks familiar.
Because the program asks to be installed, the first failure is often trust in a download, an attachment, or a support call.
Banks and customers share the damage when money moves before anyone notices the payee changed.
Out of band confirmation and transaction signing reduce that window, while removal of the program still has to happen on the affected device.
Concrete examples
- A bookkeeper installs a supposed invoice helper, and the next bank login is captured and reused the same afternoon.
- During a real transfer, extra payee details are swapped so the money leaves for an account the company did not choose.
- A support caller persuades an employee to install a remote helper that later sits on the machine used for payroll.
Protective measures
- Reach bank sites from a bookmark or a typed address rather than from a link inside an unexpected message.
- Confirm new payees or payment changes through a second channel you already know, not through the same chat that requested them.
- Limit which machines can start banking sessions, and keep those machines free of unsolicited browser addons.
- Use bank controls that sign the payee and the amount, so a hidden change on the screen is harder to submit unnoticed.
Related articles
The article What is a virus in computing? explains why a host attached virus is not the same thing as a banking disguise.
The article What is credential stuffing? covers testing stolen passwords, which can follow a banking theft or happen without one.
The article What is credit card fraud? looks at unauthorized card use, a neighboring loss that does not require banking malware.