Kaspersky Reports 1.66 Million Mobile Threat Attacks Blocked in Q3 2026
Summary
Kaspersky's Q3 2026 mobile report recorded 1.66 million attacks blocked and 378,456 malicious Android packages. It highlights banking Trojans, apps that may have used AI for fraud, and iOS spyware using DarkSword.
Key points
- Kaspersky Security Network recorded 1,668,368 attacks involving mobile malware, adware, or unwanted software in Q3, down from 1,996,823 in Q2.
- Kaspersky detected 378,456 malicious Android installation packages, including 119,688 mobile banking Trojan packages; Trojan-Bankers made up 31.63% of detected malicious apps.
- Mamont variants were the most active mobile banking Trojans in attack statistics, while Creduz accounted for the largest share of banking Trojan packages.
- A Brazilian-targeting app disguised as Google Play Protect used DistilBERT to interpret commands from a C2 server; code traces suggested server commands may have been LLM-generated.
- Researchers found infected PHP packages that injected fraudulent casino links and, on iOS devices, loaded the DarkSword exploit kit, which delivered spyware to steal personal data.
- Kaspersky reported that Trojan-Proxy.AndroidOS.Vo1d.b apps, delivered by preinstalled Trojans, turned infected devices into VPN exit nodes.
Article Details
- Publisher
- Securelist (Kaspersky)
- Report Period
- Q3 2026
- Scope
- Mobile malware, adware, and potentially unwanted software statistics, plus notable Android and iOS threats. Statistics are based on detection alerts from users who consented to provide data to Kaspersky Security Network.
- Key Statistics
- Kaspersky Security Network recorded 1,668,368 attacks involving mobile malware, adware, or unwanted software in Q3 2026, down from 1,996,823 in Q2 2026.
- Kaspersky detected 378,456 Android malware samples in Q3 2026.
- The report states that 119,688 mobile banking Trojan installation packages were detected in Q3 2026.
- Trojan-Banker accounted for 31.63% of all detected malicious apps in Q3 2026.
Malware
BTMOBAmong Trojan-Spy attacks, the biggest growth came from the BTMOB and SpyNote RAT Trojans, which are used to steal money.CreduzThe sharp rise in Trojan-Dropper apps comes from more droppers delivering known banking Trojans such as Mamont and Creduz.FaketokenTrojan-Banker.AndroidOS.Faketoken.pacHiddenAdThe number of AdWare.AndroidOS.HiddenAd and AdWare.AndroidOS.MobiDash attacks continued to decline, although adware traditionally ranks first by the number of attacked users.MamontThe sharp rise in Trojan-Dropper apps comes from more droppers delivering known banking Trojans such as Mamont and Creduz.MobiDashThe number of AdWare.AndroidOS.HiddenAd and AdWare.AndroidOS.MobiDash attacks continued to decline, although adware traditionally ranks first by the number of attacked users.SpyNoteAmong Trojan-Spy attacks, the biggest growth came from the BTMOB and SpyNote RAT Trojans, which are used to steal money.TriadaBackdoor.AndroidOS.Triada.agTrojan-Proxy.AndroidOS.Vo1d.bThe main newcomer among Q3’s most widespread malware was the Trojan-Proxy.AndroidOS.Vo1d.b apps, delivered by preinstalled Trojans.Trojan.AndroidOS.Subscriber.bhIn the third quarter, the infamous subscription Trojan detected as Trojan.AndroidOS.Subscriber.bh made it into Google Play again.
Vendors
Products
Google Play ProtectThe app was disguised as Google Play Protect, a suite of security services for Android devices.Kaspersky Security NetworkThese statistics are based on detection alerts from Kaspersky products, collected from users who consented to provide statistical data to Kaspersky Security Network.