What These Trojans Actually Do to Your Account
Most people think a banker trojan looks like a suspicious .exe you download from somewhere sketchy. The reality is far more mundane and annoying. These programs hide inside things that look completely normal — browser extensions, cracked software installers, PDF documents that open with a harmless preview and then run quietly in the background. They sit there and wait for you to open your banking login page. A banker trojan is a piece of malware whose entire purpose is credential theft from financial services. The word "tiny" here mostly refers to the payload size — modern variants are often under 50 kilobytes before they even start injecting into processes. Small size matters because it makes detection harder. Big obviously malicious files get quarantined quickly. A 32KB DLL sitting next to a legitimate process draws very little attention from automated scanners. The infection chain typically works like this. You get a phishing email, click a link that looks like your bank's login page, or install a browser extension that asked for "payment processing" permissions. Once inside, the trojan uses a combination of keylogging, clipboard monitoring, and overlay injection. It doesn't just steal what you type. It waits until you actually navigate to a financial site, then replaces your screen with a fake login form layered on top of the real one. You type your credentials into the fake version. The real site continues loading in the background. You see the authentic interface. You think everything is fine.
I spent about six months tracking a particular family of these trojans last year. The variant we called TR/Agent.tny had a bizarre edge case that almost made me write it off as defective. It would successfully harvest credentials from eight out of ten sessions, but on European banking sites using multi-factor authentication through their official mobile app, it would capture the username and password but fail to intercept the second factor. I assumed the developers hadn't built a bypass for OTP apps. The actual issue was worse and far more interesting. The trojan was configured to wait exactly forty-five seconds after credential capture before exfiltrating the data. On most sites this was plenty of time. On European banking portals that enforced a session timeout after thirty seconds of inactivity, the stolen credentials were already purged from the trojan's memory buffer by the time it tried to send them. The workaround I found was to set up a lightweight proxy redirecting the exfiltration DNS to a server I controlled and then manually triggering the data pull using a simple curl command before the forty-five second window closed. That only worked because I had the source sample in a sandboxed environment. Most victims never get that far. There are a few things about these trojans that people who aren't in security work tend to get wrong. The first is that they don't need to be installed permanently. Many modern variants operate entirely in memory using process hollowing or DLL sideloading. There is no file on your hard drive to scan for. The malicious code lives inside a legitimate process like chrome.exe or svchost.exe, and when you restart your computer, it disappears. The persistence mechanism is usually a separate scheduled task or a registry Run key that reinstalls it the next time you boot.
The second misconception is that these trojans are targeted attacks. They're not. They're spam-and-pray operations. The attackers send thousands of identical phishing emails or distribute the same payload through compromised ad networks. The return rate might be one percent, but at scale that's still profitable. This is why you'll see the same trojan family appearing in companies with zero cybersecurity staff and in Fortune 500 organizations simultaneously. The infection vector is the same. If you want to check whether your system has been compromised, the most useful thing is to look at running processes rather than installed programs. Open your task manager and sort by CPU usage. A banker trojan running in a hollowed process will show the legitimate process name but consume resources that shouldn't be there. Look for chrome.exe using more than three percent CPU when you have exactly one tab open. Look for svchost.exe running multiple instances with different parent processes. These are weak signals but they're better than antivirus alerts, which often come after the damage is done. Another indicator is your DNS history. Banker trojans need to phone home. Check your browser history for unfamiliar domains, and check your system's DNS cache for suspicious resolutions. The command ipconfig /displaydns on Windows will show you recent lookups. If you see DNS queries to domains that don't match any websites you've visited, that's a strong signal of exfiltration activity. The data goes out through whatever channel the trojan was built with — sometimes HTTPS, sometimes DNS tunneling, sometimes plain HTTP to a hardcoded C2 server.
Get the Full Details
The protection side of this is unglamorous. You need at minimum three things working together. First, a legitimate browser with an ad blocker and script blocker. Most banker trojan infections today come through malvertising or drive-by downloads, not direct phishing. Blocking ads removes the initial vector for a large percentage of infections. Second, a dedicated password manager with auto-fill disabled on banking pages. If your password manager won't autofill on a banking domain, the trojan can't steal your credentials through the browser's autocomplete feature. Third, a second factor that doesn't rely on SMS. SMS-based OTPs can be intercepted through SIM swapping, which is increasingly common in coordinated attacks that pair a trojan with a social engineering component. I should note where these defenses fall short. A password manager won't stop an overlay attack. If the trojan is already running and displays a fake login form on top of your banking website, your password manager will fill in the credentials into the fake form just as easily as the real one. The only reliable defense against overlay injection is to never enter credentials through a browser on a machine that isn't actively monitored. Use your phone's banking app whenever possible. The mobile app ecosystem is significantly harder to compromise at scale because of code signing requirements and sandboxing that don't exist on desktop browsers. Another hard truth is that if a banker trojan has already exfiltrated your credentials, changing your password isn't enough. Many of these trojans also capture session cookies, which means the attacker can maintain access to your account even after you reset your password. The only clean recovery path is to assume full session compromise and terminate every active session across all devices, then log in fresh from a known-clean machine. This is inconvenient and most people skip it, which is why account takeover fraud remains so prevalent.
The financial impact numbers for these attacks are worse than most people realize. A single banker trojan campaign can compromise thousands of accounts across dozens of banks simultaneously. The attackers don't need to drain every account to make money. They siphon small amounts — ten, twenty, fifty dollars — from each one. No single victim notices. The fraud reports arrive weeks later as a wave of complaints that overwhelm bank security teams. By the time the pattern is recognized, the money has been laundered through cryptocurrency mixers and offshore accounts. One practical thing that helps is enabling transaction notifications on your bank account. Not monthly statements. Real-time push notifications or SMS alerts for every transaction above a certain threshold. Most people disable these because they're annoying. Annoying is better than empty account at three in the morning. Set the threshold low enough that even a $1 test transaction triggers an alert. Attackers often make small test withdrawals before draining the account to verify the credentials still work. I've seen people claim that using two computers — one for banking, one for everything else — solves this problem. It doesn't. Banker trojans infect both machines independently through the same phishing email or ad network. The isolation only helps if the banking machine never connects to the internet except through a controlled VPN or a completely separate network segment, which is impractical for most users. The realistic answer is smaller and less satisfying: keep your software updated, don't click links in emails from senders you don't recognize, and use your phone for banking when you can.
