{
  "family": "tinba",
  "sample_count": 1531,
  "category": "banking_trojan",
  "description": "Tinba (Tiny Banker) is one of the smallest banking trojans publicly documented, with a footprint around 20KB that nonetheless implements full webinject, form-grabbing, and man-in-the-browser capabilities. It primarily targeted European banking customers from 2012 onward, and the leaked Tinba source code spawned multiple derivative campaigns. Tinba is often classified alongside or as Zusy by various AV vendors.",
  "cta": "If you suspect this malware on your system, do not attempt manual removal. Contact SystemHelpdesk expert MSP support at 855-783-7555 for professional incident response guidance.",
  "aliases": [
    "tinybanker",
    "zusy",
    "illibanker"
  ],
  "enrichment_level": "hand-curated",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Tinba?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Tinba (Tiny Banker) is one of the smallest banking trojans publicly documented, with a footprint around 20KB that nonetheless implements full webinject, form-grabbing, and man-in-the-browser capabilities. It primarily targeted European banking customers from 2012 onward, and the leaked Tinba source code spawned multiple derivative campaigns. Tinba is often classified alongside or as Zusy by various AV vendors."
      }
    },
    {
      "@type": "Question",
      "name": "How does Tinba spread?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Tinba (Tiny Banker) is one of the smallest banking trojans (~20KB) and spreads through exploit kits, phishing, and malvertising campaigns."
      }
    },
    {
      "@type": "Question",
      "name": "What are the signs of a Tinba infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Browser web-injects on banking sites, prompts for additional credentials or 2FA codes, and antivirus references to Tinba, TinyBanker, or Zusy are signature indicators."
      }
    },
    {
      "@type": "Question",
      "name": "What should I do if I think I have Tinba on my system?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "If you suspect this malware on your system, do not attempt manual removal. Contact SystemHelpdesk expert MSP support at 855-783-7555 for professional incident response guidance."
      }
    }
  ],
  "faq_count": 4,
  "mitre_attack": [
    "T1185",
    "T1071.001",
    "T1055"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-05-27"
}