Cybercrime has crossed a threshold. Campaigns that once demanded skilled human operators — phishing, fraud, reconnaissance — now run themselves in the background, stitched together by AI agents that need barely any supervision. For banks, the implication is stark: the adversary no longer works at human pace.

That is the central finding of a newly published study, drawn from a survey of chief information security officers across financial services. It describes a decisive change in how attackers operate, and argues that defenders are being outpaced by automation on a scale the sector has not faced before.

Cybercrime's industrial age

The report's framing is blunt: criminal operations have industrialised, assembling AI agents into pipelines that scout targets, launch phishing, dodge detection and exploit weaknesses with minimal human hands on the controls.

According to the study's authors, institutions are no longer contending with isolated, one-off intrusions but with highly automated adversaries moving at machine speed. The scale of the shift shows up in the numbers — AI-enabled attacks climbing 89% year over year — and in the behaviour of attackers mid-incident. Two-thirds of institutions reported attackers actively pushing back during a live response, working to undermine the defenders trying to contain them.

From quiet theft to open damage

The most telling change is one of intent: attackers are moving from stealing data quietly toward inflicting visible harm. More than four in ten of those surveyed were hit by a destructive attack — a signal that damage, not just exfiltration, is now the goal.

The targets are broadening in step. Alongside a 55% jump in API-based attacks, nearly half of respondents saw attempts to steal non-public market intelligence or investment strategies, pursued as aggressively as raids on actual funds. Account takeover ranked as the single most worrying threat, cited by 37%, trailed by deepfake-enhanced business email compromise and its reverse variant at 28%. A similar share confirmed "island hopping" — where attackers seize a firm's infrastructure and then turn it against that firm's own customers. Compounding the pressure, more than half of organisations reported no increase in security budget, with the report noting that security leadership remains structurally subordinated within the business.

Banks are no longer fending off isolated break-ins — they are facing automated adversaries that operate faster than any human team can respond. — On the shift to machine-speed attacks

Hiding in plain sight

To keep their infrastructure invisible, attackers are increasingly concealing instructions inside ordinary-looking images, retrievable later by malware — a technique known as steganography.

The report points to a backdoor that hides commands using encryption and encoding to open covert command-and-control channels that slip past conventional traffic inspection, and to nation-state groups pairing steganography with legitimate cloud services to sidestep endpoint monitoring entirely. Compromised cloud storage is also being used to distribute malicious code buried in images. Newer still is invisible prompt injection — a class of attack that didn't exist a couple of years ago — in which malicious instructions embedded in an image are silently read and acted on by AI systems themselves.

The RATs stalking the sector

The study singles out five remote access trojans as especially dangerous to financial institutions, each confirmed to have run campaigns against banks or crypto exchanges.

They range from a once-legitimate tool repurposed into a live surveillance platform with webcam streaming and instant keystroke capture, to a free open-source strain described as the most prolific by volume, to a nation-state fork deployed against South Korean financial and government targets with a reported billion-dollar impact. One Brazilian-operated variant fuses screen streaming, overlay injection, QR-code manipulation of instant-payment transactions and continuous keylogging into a single fraud-and-surveillance platform, and was used against 16 banks and crypto exchanges across Brazil. The most sophisticated, sold as malware-as-a-service under a US$500 lifetime licence, is described as the only tool in its class to cover every major financial attack vector from a single implant. The report's conclusion is that institutions must abandon reactive defence for proactive intrusion suppression — blending AI-powered detection with threat hunting, virtual patching, managed response, hardened defences against prompt injection and deepfake fraud, and CISOs elevated into genuinely independent executive roles.