Emerging cybersecurity threats and adaptive defence frameworks in online banking

Abstract

The rapid digitalization of financial services has exposed online banking systems to sophisticated adversarial campaigns targeting authentication layers, transaction pipelines, and third-party dependencies. This paper investigates the evolving threat landscape encompassing phishing, banking Trojans, ransomware, insider threats, zero-day exploits, and artificial intelligence (AI)-augmented attacks through a mixed-methods design combining systematic literature analysis (2018–2025) with secondary breach-dataset examination and structured case-study review. Five landmark incidents are examined: the 2019 Capital One server-side request forgery (SSRF) incident, the 2020 SolarWinds supply-chain attack, the 2021 Flagstar Bank ransomware incident, the 2023 MOVEit Transfer zero-day exploitation, and a 2024 AI-assisted spear-phishing campaign documented by Mandiant. The primary contribution is the Adaptive Layered Security Architecture (ALSA), a five-tier conceptual framework encompassing identity assurance, behavioural intelligence, transaction integrity monitoring, network and infrastructure defence, and resilience governance. Each tier is designed for bidirectional information exchange, creating a continuous adaptive feedback loop. Comparative evaluation against the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) 2.0, Payment Card Industry Data Security Standard (PCI DSS) 4.0, and the Cybersecurity and Infrastructure Security Agency (CISA) Zero Trust Maturity Model (ZTMM) confirms ALSA's superior coverage of AI-generated and insider-risk threat scenarios. Quantitative analysis of 5,247 confirmed incidents reveals phishing as the dominant initial-access vector (36.2%), followed by public-application exploitation (22.7%). Findings provide theoretical grounding for security architects and actionable guidance for institutions navigating evolving regulatory mandates. Future research directions include quantum-resistant cryptography, federated fraud detection, and large language model (LLM)-based security operations center automation.