Kaspersky blocks 1,668,368 mobile attacks in Q3 2026

By Amara Osei

Kaspersky blocked 1,668,368 attacks involving mobile malware, adware and unwanted software in Q3 2026, down from 1,996,823 in Q2.

The figures come from detection alerts raised by Kaspersky products and shared by consenting Kaspersky Security Network users. The report covers Android malware, adware and potentially unwanted software, plus notable Android and iOS threats.

What did the mobile numbers show?

• Android malware samples grew to 378,456. Kaspersky detected more than 378,000 malicious installation packages, including 119,688 mobile banking Trojan packages.
• Trojan-Banker was the prevalent mobile malware category, with a 31.63% share of all detected malicious apps.
• Standalone banking Trojans still ranked first. Together with droppers, they accounted for more than half of detected malicious apps. Droppers increased as they delivered known bankers such as Mamont and Creduz; Kaspersky said attackers were “packaging” banking Trojans.
• AdWare.AndroidOS.HiddenAd and AdWare.AndroidOS.MobiDash attacks declined, although adware traditionally ranked first by attacked-user count. Fewer adware attacks partly drove the quarterly decline.
• Among Trojan-Spy attacks, BTMOB and SpyNote RAT recorded the largest growth; both stole money.
• Kaspersky charts cover attacks from Q1 2025 through Q3 2026, installation packages from Q3 2025 through Q3 2026, and app-type and user-share data from Q2 through Q3 2026. Prior-quarter values can shift slightly after analysts revise verdicts, and user-share totals can exceed 100% when one person encounters several threat types.

Takeaway: Attack volume fell, but attackers increased their use of hidden delivery and financial-data theft.

Which campaigns widened the risk?

• In July, Kaspersky found an app targeting Brazilian users that may have used AI to automate fraud and disguised itself as Google Play Protect. Its code used DistilBERT to interpret natural-language commands from its C2 server; code traces suggest an LLM may also have generated those server-side commands.
• In August, researchers found a Trojan that analyzed gallery images and took screenshots to hunt banking data, including CVV codes. An on-device AI model classified the images, and the app could update the model to extend its functions.
• In Q3, Trojan.AndroidOS.Subscriber.bh returned to Google Play as a keyboard-theme app. It opened a subscription link in a hidden WebView, intercepted the confirmation-code message and mainly targeted users in Thailand.
• In August, Socket found 13 infected PHP packages in Packagist. They injected fraudulent-casino links into sites using them and, on iOS only, loaded the DarkSword exploit kit through a hidden iframe. Its spyware module stole keychain data, Wi-Fi passwords, SMS messages, photos and other personal information; other modules stole crypto-wallet data and recovery seed phrases.
• SlowMist found the same DarkSword chain in FomoPeek, a fake App Store crypto-wallet tracker designed to steal notes and data from crypto-wallet apps.
• Also in August, Kaspersky found infected versions of popular iOS apps distributed through Telegram. Attackers required users to buy a developer certificate; modified apps collected device information and screenshots, then sent the data to a server.

Takeaway: Attackers combined app distribution, developer certificates, package repositories and on-device AI to reach both Android and iOS users.

How did the Android rankings change?

Kaspersky’s Top 20 excludes riskware and potentially unwanted software, including RiskTool and adware. It measures unique users who encountered each verdict as a share of all attacked users of Kaspersky mobile solutions. Figures show Q2→Q3, percentage-point change and rank movement.

• Backdoor.AndroidOS.Triada.ag: 9.35%→13.14% (+3.79 p.p.; unchanged); Trojan.AndroidOS.Boogr.gsh: 3.33%→5.21% (+1.87; up two); DangerousObject.AndroidOS.GenericML: 5.25%→4.61% (-0.63; unchanged); DangerousObject.Multi.Generic: 5.65%→4.01% (-1.64; down two).
• Trojan-Proxy.AndroidOS.Vo1d.b: 0.07%→3.20% (+3.13; no prior rank); Backdoor.AndroidOS.Triada.z: 3.23%→2.85% (-0.38; down one); Trojan-Dropper.AndroidOS.Mamont.am: 0.00%→2.72% (+2.72; no prior rank); Trojan.AndroidOS.Vo1d.c: 0.00%→2.16% (+2.16; no prior rank).
• Trojan-Spy.AndroidOS.Btmob.c: 1.02%→2.09% (+1.07; up 22); Trojan.AndroidOS.Fakeapp.in: 0.00%→2.03% (+2.03; no prior rank); Trojan-Dropper.AndroidOS.Mamont.aq: 0.00%→2.03% (+2.03; no prior rank); Trojan-Banker.AndroidOS.Mamont.hl: 2.48%→2.03% (-0.45; down six).
• Backdoor.AndroidOS.Triada.ad: 1.93%→1.75% (-0.18; down one); Trojan.AndroidOS.Triada.fe: 2.18%→1.70% (-0.48; down five); Backdoor.AndroidOS.Triada.ae: 1.44%→1.67% (+0.23; up two); Trojan-Spy.AndroidOS.GGtrack.a: 1.20%→1.65% (+0.45; up eight).
• Trojan-Banker.AndroidOS.Agent.ws: 1.11%→1.46% (+0.34; up 10); Trojan-Dropper.AndroidOS.BeatBanker.c: 1.01%→1.33% (+0.32; up 14); Trojan.AndroidOS.Triada.hf: 1.93%→1.33% (-0.61; down eight); Trojan-Dropper.AndroidOS.Creduz.t: 0.00%→1.30% (+1.30; no prior rank).

Most entries were variants already popular last quarter: preinstalled Triada, Mamont bankers and BTMOB spyware.

Trojan-Proxy.AndroidOS.Vo1d.b, the main newcomer among Q3’s most widespread malware, arrived through preinstalled Trojans. It turned devices into exit nodes for a VPN service, consumed data the user might pay for while relaying other people’s traffic, and gave criminals a way to attack online services or visit banned sites, breaking the law in the victim’s name.

Takeaway: Triada led measured user share, while Vo1d.b showed how compromised phones can become network relays.

Which banking Trojans led?

After a Q2 decline, detections of Trojan-Banker installation packages began rising again. Creduz held the largest package share, but Mamont variants remained the most active in actual attacks.

• Trojan-Banker.AndroidOS.Mamont.hl: 11.13%→10.31% (-0.81 p.p.; unchanged); Trojan-Banker.AndroidOS.Agent.ws: 4.99%→7.42% (+2.43; up two); Trojan-Banker.AndroidOS.Agent.eq: 2.58%→5.58% (+3.00; up seven); Trojan-Banker.AndroidOS.Mamont.lf: 2.79%→5.10% (+2.30; up five).
• Trojan-Banker.AndroidOS.Mamont.od: 0.00%→5.05% (+5.05; no prior rank); Trojan-Banker.AndroidOS.Mamont.mv: 5.12%→4.29% (-0.83; down three); Trojan-Banker.AndroidOS.Faketoken.pac: 4.10%→3.81% (-0.29; down one).
• Trojan-Banker.AndroidOS.Agent.io: 0.30%→3.68% (+3.38; up 87); Trojan-Banker.AndroidOS.Mamont.ns: 0.24%→3.01% (+2.77; up 97); Trojan-Banker.AndroidOS.Mamont.da: 2.37%→2.97% (+0.60; up two).

These shares measure unique users who encountered each banker as a percentage of all Kaspersky mobile-security users who encountered banking threats.

Takeaway: Mamont.hl led individual banker verdicts, while rising Agent and Mamont variants produced the largest gains.