SAP patched 35 vulnerabilities in its November 2026 security updates, including four maximum-severity issues affecting its NetWeaver, Web Dispatcher, and Gateway software. The company addressed memory corruption (CVE-2026-76964) and missing authentication (CVE-2026-120017) flaws in the NetWeaver Application Server ABAP's Internet Communication Manager and SAML2 Service Provider components. NetWeaver is the core app platform that underpins SAP's business software and handles application integration, authentication, user management, and data processing. The other two maximum severity vulnerabilities stem from a broken access control weakness (CVE-2026-89103) in SAP Gateway and a memory corruption issue (CVE-2026-89126) in SAP Web Dispatcher. Gateway is a core framework that enables external apps to securely connect to SAP backend systems, while Web Dispatcher (deployed in almost every enterprise SAP environment) is a specialized component that acts as a load balancer and reverse proxy for web requests entering an SAP system architecture.
Cybersecurity company Barracuda Networks warned that attackers have begun exploiting two recently patched Email Security Gateway (ESG) vulnerabilities that let them run commands with root privileges. Barracuda released security updates to address the two flaws (tracked as CVE-2026-116606 and CVE-2026-111560) one week ago. The first stems from an Email Security Gateway (ESG) authentication weakness that can be exploited to modify an appliance's global configuration, while the second lets unauthenticated attackers inject OS commands that execute with root privileges. Barracuda also said that successful attacks require access to the administrative user interface (Admin UI) of targeted devices and advised customers to restrict access to trusted internal networks and use appropriate network access controls to limit exposure.
Google patched nine Chrome flaws, including a V8 vulnerability tracked as CVE-2026-125350, that attackers have been actively exploiting in the wild. Google has addressed multiple security vulnerabilities, one of which, tracked as CVE-2026-125350, has been actively exploited in the wild. The vulnerability is a use after free issue that resides in XML and was reported by an anonymous source on November 6, 2026.. “Google is aware that an exploit for CVE-2026-125350 exists in the wild.” reads the advisory. A Use-after-free (UAF) is a memory corruption vulnerability that occurs when a program continues to use a piece of memory after it has been released (freed). In simple terms, an application allocates memory to store data, then releases that memory when it is no longer needed. A use-after-free bug occurs when the application later tries to access that same memory location, even though it is no longer valid. Attackers may exploit a use-after-free vulnerability to crash an application and cause a denial-of-service condition, corrupt memory, or, under certain conditions, execute arbitrary code. Depending on the affected component and the nature of the flaw, successful exploitation could also allow attackers to escalate their privileges. The IT giant has not shared further details about how attackers are exploiting the vulnerability or who is behind the attacks. “Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.” continues the advisory. CVE-2026-125350 is the eighth exploited Chrome zero-day of 2026. Since the start of the year, Google has addressed the following zero-day flaws exploited in attacks in the wild: February 2026 – CVE-2026-2441 (CVSS score: 8.8) – Use after free in CSS. March 2026 – CVE-2026-3909 (CVSS score: 8.8) – Out-of-bounds write in the Skia 2D graphics library and CVE-2026-3910 (CVSS score: 8.8) – Flaw in the implementation of the V8 JavaScript/WebAssembly engine. April 2026 – CVE-2026-5281 (CVSS score: 8.8) – Use-after-free bug in Dawn, the WebGPU component used for graphics processing. June 2026 – CVE-2026-11645 (CVSS score: 8.8) – Out-of-bounds memory access in the V8 JavaScript engine September 2026 – CVE-2026-85046 (CVSS score: 8.8) – V8 type confusion flaw. September 2026 – CVE-2026-87491 (CVSS score of 8.8) – Out of bounds write in V8. Google has released Chrome 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux. The update will roll out gradually over the coming days and weeks. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Google)
The Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations. Researchers at cybersecurity company ESET documented the attacks in late 2025, initially finding modular .NET malware for Microsoft Exchange at a government body in Kazakhstan. A month later, ESET found the same toolset at a government agency in Romania, where it selectively gathered email correspondence with representatives of the North Atlantic Treaty Organization (NATO) and the European Union (EU). "After fine-tuning our detections, we found the same toolset at a governmental organization in Romania - compromised on December 23rd, 2025," the researchers say in a report today. Turla, also known as Snake, Secret Blizzard, and Waterbug, is a cyber-espionage group active for more than two decades and linked to Russia's Federal Security Service (FSB).
Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year. "Google is aware that an exploit for CVE-2026-125350 exists in the wild," the company said in a Monday security advisory. As Google explained, this flaw stems from a Use-After-Free (UAF) weakness in the XML component of the Google Chrome web browser, which occurs when the browser's XML parser processes data, deletes an object from the computer's memory, but fails to clear the pointer referencing that object. Attackers can exploit this high-severity memory corruption vulnerability when the browser later tries to use or read that "freed" memory space to manipulate the memory layout and execute malicious code. While Google has found evidence of attackers exploiting this zero-day bug in the wild, it has not shared additional details about these incidents.
IT threat evolution in Q3 2026. Non-mobile statistics IT threat evolution in Q3 2026. Mobile statistics The statistics in this report are based on detection verdicts returned by Kaspersky products unless otherwise stated. The information was provided by Kaspersky users who consented to sharing statistical data. Quarterly figures In Q3 2026: Kaspersky products blocked more than 311 million attacks launched from online resources. Web Anti-Virus responded to 47 million unique links. File Anti-Virus blocked more than 23 million malicious and potentially unwanted objects. There were 4470 new ransomware variants discovered. More than 81,000 users experienced ransomware attacks. 15% of all ransomware victims whose data was published on threat actors’ data leak sites (DLSs) were victims of Qilin. More than 217,000 users were targeted by miners. Ransomware Quarterly trends and highlights Threat actor disruption In August, the creator and lead administrator of the Ransom Cartel ransomware-as-a-service (RaaS) operation was sentenced to 16 years in prison. The convict developed the ransomware Trojan and at the time of his arrest played a central role in the RaaS operation: running the affiliate program, recruiting affiliates, supplying them with information and attack tools, working with initial access brokers, communicating with victims, and processing payments. In September, a member of the Ryuk RaaS group was sentenced to two years in prison and three years of supervised release. In 2019 and 2020, he and his accomplices breached organizations’ networks and encrypted data with the Ryuk Trojan. According to public reports, hundreds of workstations and servers were compromised. According to the prosecution, the attacker received a total of about 1610 BTC in ransom payments from victims. Also in September, a member of the Conti RaaS group was sentenced to four years in prison. He was charged with attacking companies in 2021 and 2022. In addition to carrying out attacks, he developed part of the group’s malware toolkit. Vulnerabilities and attacks In July, researchers published a report on the Qilin group exploiting the CVE-2026-0257 vulnerability in Palo Alto Networks firewall software. The vulnerability allowed attackers to bypass authentication and compromise victims’ networks without valid accounts. CISA published information in its Known Exploited Vulnerabilities Catalog (KEV) on several CVEs actively exploited by ransomware groups: CVE-2026-15409/CVE-2026-15410 in SonicWall SMA1000 remote access gateways. CISA doesn’t specify which groups exploited these vulnerabilities, but researchers have linked this activity to INC Ransom. CVE-2026-45659 in Microsoft SharePoint Server allowed an authenticated, low-privileged attacker to achieve remote code execution. CVE-2025-60710 in Microsoft Windows allowed attackers to escalate privileges locally. CVE-2026-59310 in VMware vCenter enabled unauthenticated remote code execution. CVE-2025-14733 in WatchGuard Firebox also enabled unauthenticated remote code execution. CVE-2026-63077 in JetBrains TeamCity allowed OS commands to run with the privileges of the TeamCity server process by way of an authentication bypass through the agent polling protocol. Command execution at that level could give access to configurations, credentials, CI/CD pipelines, and more. The most prolific groups This section highlights the most prolific ransomware gangs by number of victims added to each group’s DLS. Qilin (15.39%) holds first place, as it did last quarter. Qilin is followed by The Gentlemen (7.89%), which was especially active in Q1 but did not make the list in Q2. A notable newcomer on the list is Deadlock (4.46%), a relatively young ransomware family first reported in July 2025. Number of each group’s victims according to its DLS as a percentage of all groups’ victims published on all the DLSs under review during the reporting period (download) Number of new ransomware variants In Q3, Kaspersky products detected three new ransomware families and 4470 new variants, more than 1.5 times last quarter’s count. Number of new ransomware modifications, Q3 2025 – Q3 2026 (download) Number of users attacked by ransomware Trojans During the reporting period, our products protected 81,556 unique users from ransomware attacks. Users encountered ransomware most often in September. Number of unique users attacked by ransomware Trojans, Q3 2026 (download) TOP 10 countries and territories attacked by ransomware Trojans Country/territory* %** 1 China 0.83% 2 South Korea 0.65% 3 Cameroon 0.51% 4 Pakistan 0.47% 5 Tajikistan 0.45% 6 Iraq 0.43% 7 Hong Kong 0.41% 8 Uzbekistan 0.40% 9 Bangladesh 0.33% 10 Turkmenistan 0.32% * Excluded are countries and territories with relatively few (under 50,000) Kaspersky users. ** Unique users whose computers were attacked by ransomware Trojans as a percentage of all unique Kaspersky users in the country/territory. TOP 10 most common families of ransomware Trojans Name Verdict %* 1 (generic verdict) Trojan-Ransom.Win32.Gen 32.48% 2 (generic verdict) Trojan-Ransom.Win32.Crypren 6.31% 3 WannaCry Trojan-Ransom.Win32.Wanna 4.90% 4 (generic verdict) Trojan-Ransom.Win32.Encoder 4.39% 5 (generic verdict) Trojan-Ransom.Win32.Agent 4.33% 6 (generic verdict) Trojan-Ransom.Python.Agent 3.09% 7 (generic verdict) Trojan-Ransom.PowerShell.Agent 2.79% 8 (generic verdict) Trojan-Ransom.Win32.Phds 2.73% 9 (generic verdict) Trojan-Ransom.Win32.Phny 2.20% 10 (generic verdict) Trojan-Ransom.MSIL.Agent 2.10% * Unique Kaspersky users attacked by the specific ransomware Trojan family as a percentage of all unique users attacked by this type of threat. Miners Number of new miner variants In Q3 2026, Kaspersky solutions detected 2197 new miner variants. After the spike in the second quarter, it’s fair to say the pattern has returned to the calmer one typical of last year. Number of new miner modifications, Q3 2026 (download) Number of users attacked by miners In Q3, we detected miner attacks on the computers of 217,024 unique Kaspersky users worldwide. Number of unique users attacked by miners, Q3 2026 (download) TOP 10 countries and territories attacked by miners Country/territory* %** 1 Turkmenistan 2.32% 2 Tanzania 1.43% 3 Mali 1.21% 4 Senegal 1.05% 5 China 1.03% 6 Bangladesh 0.98% 7 Portugal 0.7% 8 Côte d’Ivoire 0.68% 9 Costa Rica 0.65% 10 Ethiopia 0.61% * Excluded are countries and territories with relatively few (under 50,000) Kaspersky users. ** Unique users whose computers were attacked by miners as a percentage of all unique Kaspersky users in the country/territory. Attacks on macOS Quarterly highlights At the beginning of the third quarter, Jamf researchers discovered a new stealer, PamStealer. What sets it apart is its use of Pluggable Authentication Modules (PAM) to verify the administrator password the user enters. During the quarter, Socket researchers discovered several supply chain attacks that compromised popular npm, PyPI and Cargo (the Rust package manager) packages. The malicious payloads in these packages targeted macOS systems along with others. For example, on July 11, an infected npm package, jscrambler, was published. Its malicious module was an infostealer written in Rust. The infostealer targeted crypto wallets, secrets from various services and browsers, MCP server configurations, and API keys for AI agents. In August, an attack was detected on the arrayref, internment, and append-only-vec Rust crates; it delivered a Rust backdoor to the victim’s device. In September, malicious versions of the MemTensor npm and PyPI packages were published. They delivered a Go backdoor that targeted secrets, configurations, and API tokens of various services. In August, Jamf researchers also reported discovering a new backdoor, Overlord. It was distributed as fake Zoom installers and had fairly broad spyware functionality, which is not often seen in macOS backdoors: it could eavesdrop through the microphone, watch the user through the camera, capture the screen, and log keystrokes. In the third quarter, we discovered an updated version of the MacSync crypto stealer and backdoor with a significantly changed payload delivery method. TOP 20 threats to macOS Unique users who encountered this malware as a percentage* of all attacked users of Kaspersky security solutions for macOS (download) * Data for the previous quarter may differ slightly from previously published data due to certain verdicts being retrospectively revised. The share of Ngrok, a network tunneling tool suite with both legitimate and malicious uses, continued to grow, bringing it to the top of the list. We’re also seeing more detections of the well-known Amos malware, both the traditional stealer and a version with backdoor functionality. TOP 10 countries and territories by share of attacked users Country/territory %* Q2 2026 %* Q3 2026 Brazil 1.14% 1.13% Hong Kong 0.59% 0.92% China 0.55% 1.04% India 0.55% 0.41% Germany 0.36% 0.33% Singapore 0.30% 0.85% Russia 0.21% 0.24% Japan 0.18% 0.21% Netherlands 0.16% 0.31% * Unique users who encountered threats to macOS as a percentage of all unique Kaspersky users in the country/territory. IoT threat statistics This section presents statistics on attacks targeting Kaspersky IoT honeypots. The geographic data on attack sources is based on the IP addresses of attacking devices. Distribution by protocol In Q3 2026, the share of devices attacking Kaspersky honeypots over SSH grew to 18.42%. Distribution of attacked services by number of unique IP addresses of attacking devices (download) The distribution of attacks over the Telnet and SSH protocols shows the same trend. Distribution of cybercriminal sessions in Kaspersky honeypots (download) TOP 10 threats delivered to IoT devices Share of each threat delivered to an infected device as a result of a successful attack, out of the total number of threats delivered (download) Mirai’s share of the overall IoT threat distribution declined, while other botnet threats that deliver malware grew. Attacks on IoT honeypots In the distribution of SSH attacks, the Netherlands, Bulgaria, and the US accounted for the largest shares, with the share of attacks originating from Bulgaria having grown fourfold. Germany comes next, with its share down by about half. Country/territory Q2 2026 Q3 2026 Netherlands 21.18% 27.70% Bulgaria 5.50% 20.05% United States 6.76% 10.17% Germany 16.73% 8.36% Romania 4.06% 4.20% India 2.78% 3.52% Panama 4.67% 2.19% Indonesia 1.54% 2.06% Vietnam 3.91% 2.01% Singapore 1.99% 1.42% Pakistan’s share of Telnet attacks kept growing, reaching 47.73%. Country/territory Q2 2026 Q3 2026 Pakistan 36.60% 47.73% China 35.62% 33.83% Russia 8.75% 4.65% India 4.19% 2.77% Taiwan 0.47% 1.64% Argentina 0.12% 1.45% Philippines 0.95% 1.08% United States 3.03% 0.90% Indonesia 1.52% 0.81% Germany 0.05% 0.75% Attacks via web resources The statistics in this section are based on detection verdicts by Web Anti-Virus, which protects users when suspicious objects are downloaded from malicious or infected web pages. These malicious pages are purposefully created by cybercriminals. Websites that host user-generated content, such as message boards, as well as compromised legitimate sites, can become infected. TOP 10 countries and territories that served as sources of web-based attacks The following statistics show the distribution by country/territory of the sources of internet attacks blocked by Kaspersky products on user computers (web pages redirecting to exploits, sites containing exploits and other malware, botnet C&C centers, and so on). One or more web-based attacks could originate from each unique host. To determine the geographic source of web attacks, we matched each domain name to the actual IP address hosting it, then geolocated that address (GeoIP). In Q3 2026, Kaspersky solutions blocked 311,083,655 attacks launched from online resources across the globe. Web Anti-Virus was triggered by 46,936,926 unique URLs. Web-based attacks by country/territory, Q3 2026 (download) Countries and territories where users faced the greatest risk of online infection To assess the risk of malware infection via the internet for users’ computers in different countries and territories, we calculated the share of Kaspersky users in each location on whose computers Web Anti-Virus was triggered during the reporting period. The resulting data provides an indication of the aggressiveness of the environment in which computers operate in different countries and territories. This ranked list includes only attacks by malicious objects classified as Malware. Our calculations leave out Web Anti-Virus detections of potentially dangerous or unwanted programs, such as RiskTool or adware. Country/territory* %** 1 Bangladesh 12.03 2 Taiwan 8.06 3 Venezuela 7.92 4 Vietnam 7.71 5 India 7.61 6 Belgium 6.80 7 France 6.54 8 Nepal 6.48 9 Greece 6.22 10 UAE 6.13 11 Portugal 6.10 12 Germany 5.75 13 China 5.71 14 Qatar 5.70 15 Serbia 5.58 16 Austria 5.57 17 Sri Lanka 5.40 18 Australia 5.32 19 Italy 5.31 20 Morocco 5.27 * Excluded are countries and territories with relatively few (under 10,000) Kaspersky users. ** Unique users targeted by web-based Malware attacks as a percentage of all unique users of Kaspersky products in the country/territory. On average over the quarter, 4.34% of internet users’ computers worldwide were targeted by at least one web-based Malware attack. Local threats Statistics on local infections of user computers are an important indicator. They include objects that penetrated the target computer by infecting files or removable media, or initially made their way onto the computer in non-open form. Examples of the latter are programs in complex installers and encrypted files. Data in this section is based on analyzing statistics produced by anti-virus scans of files on the hard drive at the moment they were created or accessed, and the results of scanning removable storage media. The statistics are based on detection verdicts from the On-Access Scan (OAS) and On-Demand Scan (ODS) modules of File Anti-Virus and include detections of malicious programs located on user computers or removable media connected to the computers, such as flash drives, camera memory cards, phones, or external hard drives. In Q3 2026, our File Anti-Virus recorded 23,733,652 malicious and potentially unwanted objects. Countries and territories where users faced the highest risk of local infection For each country and territory, we calculated the percentage of Kaspersky users whose computers had the File Anti-Virus triggered at least once during the reporting period. These statistics reflect the level of personal computer infection in different countries and territories worldwide. Note that this ranked list includes only attacks by malicious objects classified as Malware. Our calculations leave out File Anti-Virus detections of potentially dangerous or unwanted programs, such as RiskTool or adware. Country/territory* %** 1 Turkmenistan 45.68 2 Burundi 31.54 3 Yemen 30.31 4 China 29.93 5 Afghanistan 29.41 6 Mozambique 26.61 7 Tajikistan 26.29 8 Republic of the Congo 25.51 9 Uzbekistan 25.25 10 Cameroon 24.08 11 Democratic Republic of the Congo 23.55 12 Uganda 21.81 13 Cambodia 21.74 14 Chad 21.60 15 Syria 21.43 16 Nicaragua 21.02 17 South Sudan 20.72 18 Bangladesh 19.78 19 Mali 19.59 20 Angola 18.25 * Excluded are countries and territories with relatively few (under 10,000) Kaspersky users. ** Unique users on whose computers Malware local threats were blocked, as a percentage of all unique users of Kaspersky products in the country/territory. On average worldwide, Malware local threats were detected at least once on 10.88% of users’ computers during Q3. Russia scored 9.37% in these rankings.
IT threat evolution in Q3 2026. Non-mobile statistics IT threat evolution in Q3 2026. Mobile statistics The mobile section of the quarterly cyberthreat report includes statistics on malware, adware, and potentially unwanted software for Android, as well as descriptions of the most notable threats for Android and iOS discovered during the reporting period. These statistics are based on detection alerts from Kaspersky products, collected from users who consented to provide statistical data to Kaspersky Security Network. The quarter in figures According to Kaspersky Security Network, in Q3 2026: More than 1.66 million attacks involving mobile malware, adware, or unwanted software were blocked. The Trojan-Banker category was the prevalent mobile malware threat with a 31.63% share of all detected malicious apps. Over 378,000 malicious installation packages were detected, including 119,688 mobile banking Trojan packages. Quarterly highlights In July, we discovered a malicious app targeting Brazilian users that may have used AI to automate fraud. The app was disguised as Google Play Protect, a suite of security services for Android devices. Malicious app imitating Google Play Protect The app’s code used the DistilBERT model to interpret natural-language commands sent from the C2 server. Traces left in the code suggest the server-side commands may also have been generated by a large language model (LLM). In August, we discovered a Trojan that analyzed images saved in the device’s gallery and took screenshots to look for banking data, including CVV codes. The malware used an on-device AI model to classify images. The app could also update this model, which gave the scammers a way to expand the Trojan’s functionality. In the third quarter, the infamous subscription Trojan detected as Trojan.AndroidOS.Subscriber.bh made it into Google Play again. This time, it was disguised as an app for creating keyboard themes. Subscription Trojan disguised as a keyboard theme app The Trojan opened a subscription link in a hidden WebView and intercepted the message containing the confirmation code. According to our data, the scammers mainly targeted users in Thailand. There were also new attacks on iOS users. In August, researchers at Socket discovered 13 infected PHP packages in the Packagist repository. The malicious payload injected links to fraudulent casinos into sites that used these packages and, on iOS devices only, a hidden iframe that loaded the DarkSword exploit kit. The attack delivered a spyware module that stole keychain contents, Wi-Fi passwords, SMS messages, photos, and other personal data. Other modules found in this campaign were used to steal crypto wallet data and the seed phrases used to recover them. SlowMist researchers found the same DarkSword exploit chain used in a fake app, FomoPeek. FomoPeek was published in the App Store, presenting itself as a crypto wallet tracker. The malware was designed to steal data from notes and crypto wallet apps. Also in August, we discovered infected versions of popular iOS apps distributed through Telegram (link in Russian). To install such an app, the attackers asked users to buy a developer certificate. The modified versions contained a malicious module that collected device information, took screenshots, and sent this data to a server. Mobile threat statistics The downward trend in attacks on mobile devices involving malware, adware, or unwanted software continued: the number fell to 1,668,368 in Q3 from 1,996,823 in Q2. Attacks on users of Kaspersky mobile solutions, Q1 2025 – Q3 2026 (download) In the third quarter, this decline was driven in part by fewer adware attacks, which we examine in more detail below. The number of Android malware samples grew compared to the previous reporting period, reaching 378,456. Detected malicious and potentially unwanted installation packages, Q3 2025 – Q3 2026 (download) The distribution of detected installation packages by type was as follows: Detected mobile apps by type, Q2*–Q3 2026 (download) * Data for the previous quarter may differ slightly from previously published data due to certain verdicts being retrospectively revised. The sharp rise in Trojan-Dropper apps comes from more droppers delivering known banking Trojans such as Mamont and Creduz. In the previous quarter, we described the trend of attackers “packaging” banking Trojans. The resulting malware is classified as droppers, which explains the growth. Note that standalone banking Trojans still rank first. Together with droppers, they account for more than half of all detected malicious apps. Share* of users attacked by the given type of malicious or potentially unwanted apps out of all targeted users of Kaspersky mobile products, Q2–Q3 2026 (download) * The total percentage may exceed 100% if the same users encountered multiple attack types. The number of AdWare.AndroidOS.HiddenAd and AdWare.AndroidOS.MobiDash attacks continued to decline, although adware traditionally ranks first by the number of attacked users. The growing share of Trojan-Dropper correlates with the increase in packaged banking Trojans described in the previous section. Among Trojan-Spy attacks, the biggest growth came from the BTMOB and SpyNote RAT Trojans, which are used to steal money. TOP 20 types of mobile malware Note that the malware rankings below exclude riskware or potentially unwanted software, such as RiskTool or adware. Verdict %* Q2 2026 %* Q3 2026 Difference in p.p. Change in ranking Backdoor.AndroidOS.Triada.ag 9.35 13.14 +3.79 0 Trojan.AndroidOS.Boogr.gsh 3.33 5.21 +1.87 +2 DangerousObject.AndroidOS.GenericML. 5.25 4.61 -0.63 0 DangerousObject.Multi.Generic. 5.65 4.01 -1.64 -2 Trojan-Proxy.AndroidOS.Vo1d.b 0.07 3.20 +3.13 Backdoor.AndroidOS.Triada.z 3.23 2.85 -0.38 -1 Trojan-Dropper.AndroidOS.Mamont.am 0.00 2.72 +2.72 Trojan.AndroidOS.Vo1d.c 0.00 2.16 +2.16 Trojan-Spy.AndroidOS.Btmob.c 1.02 2.09 +1.07 +22 Trojan.AndroidOS.Fakeapp.in 0.00 2.03 +2.03 Trojan-Dropper.AndroidOS.Mamont.aq 0.00 2.03 +2.03 Trojan-Banker.AndroidOS.Mamont.hl 2.48 2.03 -0.45 -6 Backdoor.AndroidOS.Triada.ad 1.93 1.75 -0.18 -1 Trojan.AndroidOS.Triada.fe 2.18 1.70 -0.48 -5 Backdoor.AndroidOS.Triada.ae 1.44 1.67 +0.23 +2 Trojan-Spy.AndroidOS.GGtrack.a 1.20 1.65 +0.45 +8 Trojan-Banker.AndroidOS.Agent.ws 1.11 1.46 +0.34 +10 Trojan-Dropper.AndroidOS.BeatBanker.c 1.01 1.33 +0.32 +14 Trojan.AndroidOS.Triada.hf 1.93 1.33 -0.61 -8 Trojan-Dropper.AndroidOS.Creduz.t 0.00 1.30 +1.30 * Unique users who encountered this malware as a percentage of all attacked users of Kaspersky mobile solutions Most of the list is made up of variants of Trojans that were already popular last quarter: several versions of the preinstalled Triada Trojan, Mamont bankers, and BTMOB spyware. The main newcomer among Q3’s most widespread malware was the Trojan-Proxy.AndroidOS.Vo1d.b apps, delivered by preinstalled Trojans. These apps turn the device into an exit node of a VPN service. These attacks are dangerous for two reasons. First, they burn through internet traffic, which the user may be paying for, to relay other people’s data. Second, cybercriminals can use the infected device to attack online services and visit banned websites, breaking the law in the victim’s name. Mobile banking Trojans In Q3 2026, the number of Trojan-Banker installation packages began rising again after a drop last quarter. Number of installation packages for mobile banking Trojans detected by Kaspersky, Q3 2025 – Q3 2026 (download) By type, Creduz again accounts for the largest share of banking Trojans. However, as in Q2, the statistics of actual attacks tell a different story: Mamont variants were again the most active Trojans. TOP 10 mobile bankers Verdict %* Q2 2026 %* Q3 2026 Difference in p.p. Change in ranking Trojan-Banker.AndroidOS.Mamont.hl 11.13 10.31 -0.81 0 Trojan-Banker.AndroidOS.Agent.ws 4.99 7.42 +2.43 +2 Trojan-Banker.AndroidOS.Agent.eq 2.58 5.58 +3.00 +7 Trojan-Banker.AndroidOS.Mamont.lf 2.79 5.10 +2.30 +5 Trojan-Banker.AndroidOS.Mamont.od 0.00 5.05 +5.05 Trojan-Banker.AndroidOS.Mamont.mv 5.12 4.29 -0.83 -3 Trojan-Banker.AndroidOS.Faketoken.pac 4.10 3.81 -0.29 -1 Trojan-Banker.AndroidOS.Agent.io 0.30 3.68 +3.38 +87 Trojan-Banker.AndroidOS.Mamont.ns 0.24 3.01 +2.77 +97 Trojan-Banker.AndroidOS.Mamont.da 2.37 2.97 +0.60 +2 * Unique users who encountered this malware as a percentage of all Kaspersky mobile security solution users who encountered banking threats
An iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it. The updates also fix a separate iMessage flaw that could let someone added to a group access messages sent before they joined. As of today, other updates released yesterday for the iPhone XS, XS Max and XR, the iPad (7th generation) and some Apple
The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal that's used to break into victims' Microsoft Exchange servers with an aim to surreptitiously collect emails. According to an ESET report shared with The Hacker News ahead of publication, the sophisticated and modular tool is designed for
Four flaws that attackers could exploit without logging in were fixed today as part of SAP's monthly Security Patch Day—the vendor rates all four 10.0, the maximum CVSS score. Three are in the SAP NetWeaver application server, the software SAP systems run on, and one is in the Web Dispatcher, which receives web requests from the internet and passes them on to that server. The flaws in the Web
Confirm this action.
Leaving now will discard your changes.