Kaspersky’s 2025 Security Bulletin paints a sobering picture of what lies ahead for the global financial sector, warning that the cyber threats banks grappled with in 2025 were only a prelude to a far more complex and adaptive crisis expected in 2026.
According to the report, cybercriminal activity over the past year revealed a clear shift toward intelligence-driven attacks. Malware increasingly spread through messaging platforms rather than email, artificial intelligence was weaponised to enhance attack precision, and supply chain vulnerabilities became a preferred entry point into high-value financial systems.
At the heart of the looming threat is the rise of “agentic AI” malware, self-directed malicious code capable of making decisions in real time. Unlike traditional malware that follows predefined instructions, these advanced threats can analyse defensive environments, alter their behaviour mid-attack, and move fluidly across systems to avoid detection. Financial institutions, the report warns, may find themselves facing attacks that learn and adapt faster than human-led security operations can respond.
Kaspersky notes that supply chain attacks are becoming especially dangerous. Rather than targeting banks directly, attackers increasingly exploit weaker third-party partners, using trusted connections to breach core payment networks and sensitive infrastructure.
Human vulnerability remains a critical weak point. The report highlights a surge in AI-generated deepfake attacks used for social engineering, including realistic voice and video impersonations. Criminals have deployed fake job interviews and executive-style communications to deceive employees into handing over sensitive data. These techniques are also fuelling a growing underground market for tools designed to bypass Know Your Customer (KYC) systems, enabling the creation of synthetic identities at scale.
Traditional banking malware has not disappeared but has evolved. Trojans once distributed primarily through phishing emails are now spreading through messaging apps such as WhatsApp. Attackers disguise malicious files as routine documents shared within trusted group chats, targeting organisations that still rely on desktop-based online banking platforms.
The threat landscape is also fragmenting. Instead of single large-scale global attacks, banks are facing waves of smaller, regional incursions. These localised information-stealing campaigns use malware-as-a-service models to harvest credentials in specific countries or markets, making detection and attribution more difficult.
Beyond digital channels, physical and hybrid threats are rising. Kaspersky reports an increase in attacks targeting near-field communication (NFC) payment systems, enabling fraud both in crowded public spaces and remotely through fake mobile banking applications. Compounding the risk is the growing circulation of pre-infected devices, including grey-market smartphones and smart TVs embedded with banking trojans before purchase.
Taken together, the report concludes, the defining feature of the 2026 cyber threat environment will be convergence. Attacks will blend artificial intelligence, human manipulation, physical access, and software vulnerabilities into coordinated campaigns that challenge existing security models.
For financial institutions, Kaspersky’s warning is clear: the next phase of cybercrime will not be fought against static code or isolated phishing attempts, but against adaptive, autonomous threats operating across multiple fronts at once.
