Over the past year or so, attacks on banks and financial institutions haven’t only got more frequent, they’ve also become more professional, more business-like. Fraud has always been a ‘business’ for those who commit it, with them investing time and tools to achieve a fraudulent financial return. But what we’re seeing now are operations on a completely different scale.
A new operating model for attackers
The clearest signal of the shift in approach is the rise of malware-as-a-service (MaaS). Building the malware for attacks on banks used to require a level of technical expertise that was relatively rare, with elite developers, often nation-state affiliated, creating bespoke tooling for high-value campaigns.
Generative AI and open-source tooling have removed that barrier almost entirely. Capabilities that would have required months of specialist development can now be assembled in hours. ‘Affiliates’ can buy access to fully commercialised attack platforms, complete with modular infrastructure, support channels and ready-made obfuscation pipelines. The fraud supply chain has matured.
The practical consequence is a step change in attack velocity and geographic reach. Attacks that previously required proximity – social, cultural, or physical – can now be deployed from anywhere, against anyone, with none of the operational overhead that used to slow attack campaigns down. Geographic boundaries no longer offer meaningful protection.
The session is the new transaction
Many financial services businesses today recognise that the way fraudsters operate has fundamentally changed. Yet many of them are still committed to fraud controls that were not designed for today’s threats. Because modern attacks don’t happen at the point of payment: they happen long before it.
The shift we’ve been tracking at Cleafy over the past 18 months is a move from transactional interference to full-session compromise. Sophisticated malware families are now using device accessibility features and remote access capabilities to operate as the legitimate user – inside authenticated sessions, before any payment instruction is even formed.
It’s a fundamental problem for controls built around the transaction moment. Step-up authentication, biometrics, device verification – these are genuinely valuable layers of defence, but if an attacker is already operating as a user within a verified session, they become largely irrelevant. Detection that triggers at payment is simply too late.
In addition, the attack surface has expanded well beyond banking applications themselves. NFC weaponisation, for instance, has created a new class of mobile-enabled payment fraud. Mobile wallets, contactless payments, digital cards: these are all attack vectors now, not just the banking app on someone’s home screen.
Two teams chasing the same attacker through different doors
One of the most consistent patterns that comes up in conversations with fraud and security leaders is that fraud teams see the financial outcome, while security teams see the technical event. They’re both responding to the same attack, but through different processes, with different KPIs, different tooling and unfortunately, often no shared intelligence.
This made some sense when fraud was largely social engineering and cyber was mostly perimeter defence. But not in a world where malware enables a fraudster to trigger a payment from inside an authenticated session. It’s not clear whether attackers understand the organisational boundary between the security operations centre (SOC) and the fraud desk, but they have certainly been exploiting the gap between them for years.
Closing that gap – genuinely, not just by adding a dashboard that shows both feeds – is one of the most important structural changes financial institutions can make. Unified intelligence, where the technical event and the financial behaviour are understood as a single attack narrative, can fundamentally change fraud outcomes.
AI is the threat, and AI is the answer
We have first-party evidence that threat actors are using AI to accelerate malware development. The same tools that are driving productivity gains across every industry are being used to build, iterate and deploy attacks at a speed and scale that no human-led fraud team can match.
The only realistic defence against this onslaught of AI-enabled attacks is AI-powered detection and response. Not because AI is considered the solution to every business challenge these days, but because a human-powered alternative just can’t scale to the problem.
You can’t employ enough analysts or create enough new dashboards to keep up. But you can use AI to sort through the huge volume of signals, triaging those that can be handled autonomously and prioritising the cases that most need human judgement. AI can speedily absorb intelligence, which means fewer, high-quality alerts for fraud teams to assess, which in turn means faster decisions and reduced friction for legitimate customers.
A problem we can’t afford to ignore
None of this is speculative: the industrialisation of fraud is already happening on a massive scale. The malware families Cleafy’s threat intelligence team have tracked over the last 18 months include commercialised MaaS platforms, next-generation remote access trojans (RATs) for banking, NFC-enabled payment fraud and more. They aren’t rare or fringe occurrences. They are central to how banking operates.
What isn’t as advanced is the industry’s defensive infrastructure. Fraud controls built around transaction scoring and signature-based detection, or which require significant human triaging, are designed for an antiquated threat model.
The gap between sophistication of threat and institutional response is widening. And it’s the institutions moving decisively towards session-layer intelligence – combining behavioural analytics, device integrity signals, malware-specific telemetry and genuinely fused cyber-fraud response – that will be able to keep up with an adversary that’s had a head start and is accelerating.
By Luca Collaciani, chief growth officer (CGO) at Cleafy.
- Cybersecurity in FinTech