MILAN, Italy – 17 September 2026 - For decades, defence against malware has depended on classification: capture a sample, analyse it, assign it to a family, publish a signature. Everyone downstream is then protected from that variant. The model rests on an assumption so old it is rarely questioned: that malware evolves slowly enough to be catalogued.
Generative AI has broken that assumption. Criminal developers now produce new variants of banking malware in hours rather than weeks, at almost no cost, and a variant built an hour ago has no signature of its own, however well understood its ancestors are. A signature is evidence of yesterday’s malware; it cannot describe software that has never been seen before. To a signature-based defence, an application without a name is invisible. The hours, sometimes days, between a variant first appearing and its formal classification are when the damage is done.
Kaspersky recorded a 188% surge in NFC relay attacks on smartphones in the first four months of 2026, driven by malware families including SuperCard X. When Cleafy’s threat intelligence team uncovered SuperCard X in April 2025, antivirus engines did not yet recognise it: the malware was already relaying stolen card data in live fraud operations before it had a name.
Today Cleafy, whose platform protects more than 250 million digital banking users worldwide and whose researchers uncovered SuperCard X along with banking malware families including SharkBot and TeaBot, announced Mobile Malware Early Detection, a capability that identifies malicious mobile applications in real time, before a formal signature exists. Proprietary AI models pre-classify suspicious applications and issue a real-time signal that works with a bank’s existing Cleafy rules and policies. Fraud teams can use it to trigger step-up authentication, hold transactions or feed watchlists, without changing how their operations run.
For banks, the arithmetic is uncomfortable. They do not lose money to sophisticated malware; they lose it to unclassified malware. Until now, the options during that gap have been to wait for classification and accept the exposure, or to act on incomplete evidence and risk disrupting legitimate customers. Early Detection introduces a third option: decide.
For fraud teams, that changes the operational question. Instead of asking, “Has this application already been classified as malware?”, they can ask, “Do we have enough evidence to act now?”
The capability is not a pilot. It has run in production at a major European bank for more than a year, its signals feeding live fraud and security decisioning. Over that period, 99.9% of its pre-classifications were confirmed as true positives, and 96% of applications later confirmed as malicious were flagged before any formal signature existed. The service is calibrated to stay silent rather than guess: borderline cases are deferred and covered by conventional signature-based detection afterwards.
Each pre-classification carries a human-readable explanation: the suspected malware family, an analysis of the permissions the application requests, and the reasons it was flagged. Analysts see the evidence, not just the verdict.
“Every malware signature ever written answers the same question: what is this malware called?” said Carmine Giangregorio, Co-founder and Product Manager at Cleafy. “That is the wrong question, asked too late.The question that matters is what the application is doing, and whether we know enough to act now. A bank that can answer that no longer has to wait for a name.”
About Cleafy
Cleafy helps banks stop financial fraud through Autonomous Fraud Operations. Rather than adding another tool for analysts, Cleafy investigates cases, produces evidence-based decisions and adapts to changing criminal tactics in production. European banks have been running Cleafy's Autonomous Fraud Operations since December 2025, enabling fraud teams to prevent more fraud losses while focusing human expertise where it adds the greatest value.
www.cleafy.com
