IT threat evolution in Q3 2026. Mobile statistics

IT threat evolution in Q3 2026. Non-mobile statistics

IT threat evolution in Q3 2026. Mobile statistics

The mobile section of the quarterly cyberthreat report includes statistics on malware, adware, and potentially unwanted software for Android, as well as descriptions of the most notable threats for Android and iOS discovered during the reporting period. These statistics are based on detection alerts from Kaspersky products, collected from users who consented to provide statistical data to Kaspersky Security Network.

The quarter in figures

According to Kaspersky Security Network, in Q3 2026:

More than 1.66 million attacks involving mobile malware, adware, or unwanted software were blocked.

The Trojan-Banker category was the prevalent mobile malware threat with a 31.63% share of all detected malicious apps.

Over 378,000 malicious installation packages were detected, including 119,688 mobile banking Trojan packages.

Quarterly highlights

In July, we discovered a malicious app targeting Brazilian users that may have used AI to automate fraud. The app was disguised as Google Play Protect, a suite of security services for Android devices.

Malicious app imitating Google Play Protect

The app’s code used the DistilBERT model to interpret natural-language commands sent from the C2 server. Traces left in the code suggest the server-side commands may also have been generated by a large language model (LLM).

In August, we discovered a Trojan that analyzed images saved in the device’s gallery and took screenshots to look for banking data, including CVV codes. The malware used an on-device AI model to classify images. The app could also update this model, which gave the scammers a way to expand the Trojan’s functionality.

In the third quarter, the infamous subscription Trojan detected as Trojan.AndroidOS.Subscriber.bh made it into Google Play again. This time, it was disguised as an app for creating keyboard themes.

Subscription Trojan disguised as a keyboard theme app

The Trojan opened a subscription link in a hidden WebView and intercepted the message containing the confirmation code. According to our data, the scammers mainly targeted users in Thailand.

There were also new attacks on iOS users. In August, researchers at Socket discovered 13 infected PHP packages in the Packagist repository. The malicious payload injected links to fraudulent casinos into sites that used these packages and, on iOS devices only, a hidden iframe that loaded the DarkSword exploit kit. The attack delivered a spyware module that stole keychain contents, Wi-Fi passwords, SMS messages, photos, and other personal data. Other modules found in this campaign were used to steal crypto wallet data and the seed phrases used to recover them.

SlowMist researchers found the same DarkSword exploit chain used in a fake app, FomoPeek. FomoPeek was published in the App Store, presenting itself as a crypto wallet tracker. The malware was designed to steal data from notes and crypto wallet apps.

Also in August, we discovered infected versions of popular iOS apps distributed through Telegram (link in Russian). To install such an app, the attackers asked users to buy a developer certificate. The modified versions contained a malicious module that collected device information, took screenshots, and sent this data to a server.

Mobile threat statistics

The downward trend in attacks on mobile devices involving malware, adware, or unwanted software continued: the number fell to 1,668,368 in Q3 from 1,996,823 in Q2.

Attacks on users of Kaspersky mobile solutions, Q1 2025 – Q3 2026 (download)

In the third quarter, this decline was driven in part by fewer adware attacks, which we examine in more detail below.

The number of Android malware samples grew compared to the previous reporting period, reaching 378,456.

Detected malicious and potentially unwanted installation packages, Q3 2025 – Q3 2026 (download)

The distribution of detected installation packages by type was as follows:

Detected mobile apps by type, Q2*–Q3 2026 (download)

* Data for the previous quarter may differ slightly from previously published data due to certain verdicts being retrospectively revised.

The sharp rise in Trojan-Dropper apps comes from more droppers delivering known banking Trojans such as Mamont and Creduz. In the previous quarter, we described the trend of attackers “packaging” banking Trojans. The resulting malware is classified as droppers, which explains the growth. Note that standalone banking Trojans still rank first. Together with droppers, they account for more than half of all detected malicious apps.

Share* of users attacked by the given type of malicious or potentially unwanted apps out of all targeted users of Kaspersky mobile products, Q2–Q3 2026 (download)

* The total percentage may exceed 100% if the same users encountered multiple attack types.

The number of AdWare.AndroidOS.HiddenAd and AdWare.AndroidOS.MobiDash attacks continued to decline, although adware traditionally ranks first by the number of attacked users. The growing share of Trojan-Dropper correlates with the increase in packaged banking Trojans described in the previous section. Among Trojan-Spy attacks, the biggest growth came from the BTMOB and SpyNote RAT Trojans, which are used to steal money.

TOP 20 types of mobile malware

Note that the malware rankings below exclude riskware or potentially unwanted software, such as RiskTool or adware.

Verdict<br>%* Q2 2026<br>%* Q3 2026<br>Difference in p.p.<br>Change in ranking

Backdoor.AndroidOS.Triada.ag<br>9.35<br>13.14<br>+3.79<br>0

Trojan.AndroidOS.Boogr.gsh<br>3.33<br>5.21<br>+1.87<br>+2

DangerousObject.AndroidOS.GenericML.<br>5.25<br>4.61<br>-0.63<br>0

DangerousObject.Multi.Generic.<br>5.65<br>4.01<br>-1.64<br>-2

Trojan-Proxy.AndroidOS.Vo1d.b<br>0.07<br>3.20<br>+3.13

Backdoor.AndroidOS.Triada.z<br>3.23<br>2.85<br>-0.38<br>-1

Trojan-Dropper.AndroidOS.Mamont.am<br>0.00<br>2.72<br>+2.72

Trojan.AndroidOS.Vo1d.c<br>0.00<br>2.16<br>+2.16

Trojan-Spy.AndroidOS.Btmob.c<br>1.02<br>2.09<br>+1.07<br>+22

Trojan.AndroidOS.Fakeapp.in<br>0.00<br>2.03<br>+2.03

Trojan-Dropper.AndroidOS.Mamont.aq<br>0.00<br>2.03<br>+2.03

Trojan-Banker.AndroidOS.Mamont.hl<br>2.48<br>2.03<br>-0.45<br>-6

Backdoor.AndroidOS.Triada.ad<br>1.93<br>1.75<br>-0.18<br>-1

Trojan.AndroidOS.Triada.fe<br>2.18<br>1.70<br>-0.48<br>-5

Backdoor.AndroidOS.Triada.ae<br>1.44<br>1.67<br>+0.23<br>+2

Trojan-Spy.AndroidOS.GGtrack.a<br>1.20<br>1.65<br>+0.45<br>+8

Trojan-Banker.AndroidOS.Agent.ws<br>1.11<br>1.46<br>+0.34<br>+10

Trojan-Dropper.AndroidOS.BeatBanker.c<br>1.01<br>1.33<br>+0.32<br>+14

Trojan.AndroidOS.Triada.hf<br>1.93<br>1.33<br>-0.61<br>-8

Trojan-Dropper.AndroidOS.Creduz.t<br>0.00<br>1.30<br>+1.30

* Unique users who encountered this malware as a percentage of all attacked users of Kaspersky mobile solutions

Most of the list is made up of variants of Trojans that were already popular last quarter: several versions of the preinstalled Triada Trojan, Mamont bankers, and BTMOB spyware.

The main newcomer among Q3’s most widespread malware was the Trojan-Proxy.AndroidOS.Vo1d.b apps, delivered by preinstalled Trojans. These apps turn the device into an exit node of a VPN service. These attacks are dangerous for two reasons. First, they burn through internet traffic, which the user may be paying for, to relay other people’s data. Second, cybercriminals can use the infected device to attack online services and visit banned websites, breaking the law in the victim’s name.

Mobile banking Trojans

In Q3 2026, the number of Trojan-Banker installation packages began rising again after a drop last quarter.

Number of installation packages for mobile banking Trojans detected by Kaspersky, Q3 2025 – Q3 2026 (download)

By type, Creduz again accounts for the largest share of banking Trojans. However, as in Q2, the statistics of actual attacks tell a different story: Mamont variants were again the most active Trojans.

TOP 10 mobile bankers

Verdict<br>%* Q2 2026<br>%* Q3 2026<br>Difference in p.p.<br>Change in ranking

Trojan-Banker.AndroidOS.Mamont.hl<br>11.13<br>10.31<br>-0.81<br>0

Trojan-Banker.AndroidOS.Agent.ws<br>4.99<br>7.42<br>+2.43<br>+2

Trojan-Banker.AndroidOS.Agent.eq<br>2.58<br>5.58<br>+3.00<br>+7

Trojan-Banker.AndroidOS.Mamont.lf<br>2.79<br>5.10<br>+2.30<br>+5

Trojan-Banker.AndroidOS.Mamont.od<br>0.00<br>5.05<br>+5.05

Trojan-Banker.AndroidOS.Mamont.mv<br>5.12<br>4.29<br>-0.83<br>-3

Trojan-Banker.AndroidOS.Faketoken.pac<br>4.10<br>3.81<br>-0.29<br>-1

Trojan-Banker.AndroidOS.Agent.io<br>0.30<br>3.68<br>+3.38<br>+87

Trojan-Banker.AndroidOS.Mamont.ns<br>0.24<br>3.01<br>+2.77<br>+97

Trojan-Banker.AndroidOS.Mamont.da<br>2.37<br>2.97<br>+0.60<br>+2

* Unique users who encountered this malware as a percentage of all Kaspersky mobile security solution users who encountered banking threats