{
  "family": "zusy",
  "sample_count": 14120,
  "category": "banking_trojan",
  "description": "Zusy, also known as Tinba (Tiny Banker), is a notably compact banking trojan that gained attention for its small footprint of roughly 20KB while still implementing full webinject and form-grabbing capability. First seen around 2012, Zusy primarily targeted European banking customers through phishing and exploit kits. Its small size made detection harder and demonstrated that effective banking trojans did not require large code bases. The leaked Tinba source code spawned numerous derivative campaigns.",
  "cta": "If you suspect this malware on your system, do not attempt manual removal. Contact SystemHelpdesk expert MSP support at 855-783-7555 for professional incident response guidance.",
  "aliases": [
    "tinba",
    "tinybanker",
    "illibanker"
  ],
  "enrichment_level": "hand-curated",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Zusy?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Zusy, also known as Tinba (Tiny Banker), is a notably compact banking trojan that gained attention for its small footprint of roughly 20KB while still implementing full webinject and form-grabbing capability. First seen around 2012, Zusy primarily targeted European banking customers through phishing and exploit kits. Its small size made detection harder and demonstrated that effective banking trojans did not require large code bases. The leaked Tinba source code spawned numerous derivative campaigns."
      }
    },
    {
      "@type": "Question",
      "name": "How does Zusy spread?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Zusy is an alias for Tinba and spreads through the same exploit kits, phishing campaigns, and malvertising used by the Tiny Banker family."
      }
    },
    {
      "@type": "Question",
      "name": "What are the signs of a Zusy infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Browser web-injects on banking sites, prompts for additional 2FA codes, and AV detections for Zusy, Tinba, or TinyBanker are diagnostic."
      }
    },
    {
      "@type": "Question",
      "name": "What should I do if I think I have Zusy on my system?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "If you suspect this malware on your system, do not attempt manual removal. Contact SystemHelpdesk expert MSP support at 855-783-7555 for professional incident response guidance."
      }
    }
  ],
  "faq_count": 4,
  "mitre_attack": [
    "T1185",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-05-27"
}