Tinba
Aliases: Illi, TinyBanker, Zusy
- Malware type
- trojan, credential-stealer
- Family
- Malware family
- Last IoC activity
- 2026-07-22 01:17:16
- Profile updated
- 2026-07-07 13:44:46
Targeted industries: financial-services
Targeted regions: country_code:us country_code:de
Context
F-Secure notes that TinyBanker or short Tinba is usually distributed through malvertising (advertising content that leads the user to sites hosting malicious threats), exploit kits and spam email campaigns. According to news reports, Tinba has been found targeting bank customers in the United States and Europe. If Tinba successfully infects a device, it can steal banking and personal information through webinjects. To do this, the malware monitors the user's browser activity and if specific banking portals are visited, Tinba injects code to present the victim with fake web forms designed to mimic the legitimate web site. The malware then tricks them into entering their personal information, log-in credentials, etc in the legitimate-looking page. Tinba may also display socially-engineered messages to lure or pressure the user into entering their information on the fake page; for example, a message may be shown which attempts to convince the victim that funds were accidentally deposited to his account and must be refunded immediately.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Tinba_Auto (yara-rule)
Reports & references
- ESET — Eset Threat Report Q22020 (report)
- f5.com — Banking Trojans A Reference Guide To The Malware Family Tree (report)
- Cisco Talos — Threat Roundup 0204 0211 (report)
- adalogics.com — The State Of Advanced Code Injections (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Tinba (report)
- securityblog.switch.ch — So Long And Thanks For All The Domains (report)
- securityintelligence.com — Tinba Trojan Sets Its Sights On Romania (report)
- theregister.co.uk — Small Banking Trojan (report)
- garage4hackers.com — Entry (report)
- stopmalvertising.com — Mini Analysis Of The Tinybanker Tinba (report)
- securityintelligence.com — Tinba Malware Reloaded And Attacking Banks Around The World (report)
- zscaler.com — Look Recent Tinba Banking Trojan Variant (report)
- contagiodump.blogspot.com — Amazon (report)
- blogs.blackberry.com — Blackberry Cylance Vs Tinba Banking Trojan (report)
- Trend Micro — Wp W32 Tinba Tinybanker (report)