A new report released by Kaspersky has revealed alarming trends in financial cybercrime, highlighting that more than one million online banking accounts were compromised in 2025 due to the rapid rise of infostealer malware and credential-based attacks.
According to the report, cybercriminals are shifting away from traditional PC banking malware and increasingly relying on social engineering tactics and dark web marketplaces, while also expanding attacks targeting mobile devices.
Despite evolving tactics, financial phishing remains a dominant threat. Fake pages mimicking online stores accounted for 48.5% of phishing attacks in 2025, marking a 10.3% increase compared to 2024.
This was followed by phishing pages impersonating banks at 26.1%, down by 16.5%, and payment systems at 25.5%, up by 6.2%.
The decline in bank-targeted phishing suggests that impersonating financial institutions has become more difficult, prompting cybercriminals to shift toward easier targets such as e-commerce platforms.
Middle East: A Hotspot for E-commerce Scams
The report highlights that 85.8% of financial phishing attacks in the Middle East are focused on e-commerce, reflecting the growing popularity of online shopping and its exploitation by fraudsters.
In contrast, Africa recorded the highest share of bank-related phishing at 53.75%, while Latin America showed a more balanced distribution. Meanwhile, Asia-Pacific and Europe displayed a relatively even spread across all categories, indicating diversified attack strategies.
Rise of Mobile Financial Threats
The number of users affected by financial malware on PCs continued to decline in 2025, as more users shifted to mobile banking. However, mobile banking attacks increased by 1.5 times year-on-year, signaling a growing threat in the mobile ecosystem.
Infostealers Driving Cybercrime
Infostealer malware has become a key enabler of financial fraud, collecting sensitive data such as login credentials, cookies, bank card details, cryptocurrency wallet seed phrases, and autofill data.
Kaspersky data shows a significant surge in infostealer detections, rising 59% globally, 53% in Africa, and 26% in the Middle East between 2024 and 2025, fueling credential-based cyberattacks.
Over One Million Accounts Exposed
According to Kaspersky Digital Footprint Intelligence (DFI), over one million online banking accounts across the world’s top 100 banks were compromised, with stolen credentials widely circulated on the dark web.
India, Spain, and Brazil recorded the highest median number of compromised accounts per bank.
Stolen Payment Cards Still Active
The report also revealed that 74% of compromised payment cards identified on dark web platforms in 2025 remained valid as of March 2026, indicating that attackers can continue exploiting stolen financial data months or even years later.
A Self-Sustaining Cybercrime Ecosystem
Commenting on the findings, Polina Tretyak, Digital Footprint Intelligence Analyst at Kaspersky, stated that the dark web has evolved into a central hub for financial cybercrime.
She explained that stolen credentials and payment data are aggregated, repackaged, and sold, while phishing kits are offered as ready-to-use tools—creating a scalable and accessible ecosystem even for low-skilled attackers.
She emphasized that breaking this cycle requires proactive threat intelligence from organizations and increased awareness among individual users.
