Loading malware…
Android.Banker is a family of Android banking trojans that Dr.Web reported as one of the most widespread and commonly detected categories of malicious Android software across 2025 and into Q1 and Q2 2026. Its activity increased significantly in late 2025 and Q1 2026, including a reported increase of more than 2.5 times over the prior three months, and it remained the most widespread banking malware on protected Android devices. Dr.Web identified the Android.Banker.Mamont subfamily as the most widespread variant in Q1 2026. High-confidence behaviors described for this malware family include intercepting SMS messages containing one-time banking transaction confirmation codes, displaying phishing windows, and imitating legitimate banking applications in order to steal confidential data and gain unauthorized access to victims’ banking accounts and funds. The reporting also states that malware authors increasingly used Android app modding and obfuscation tools, including junk-code insertion detected as Tool.Obfuscator.TrashCode and NP Manager modifications detected as Tool.NPMod, to help Android.Banker samples evade antivirus detection. The provided content does not attribute Android.Banker to a specific threat actor, industry vertical, or geography beyond Dr.Web’s general Android telemetry.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
malware writers continued actively using various tools for modding Android apps to shield their malware from anti-virus detection.
Topping the list of the most commonly detected potentially dangerous software were apps to which junk code has been added with the help of Android program modification tools... Currently, this technique is actively being used to protect banking trojans from anti-virus detection.
Members of the Android.HiddenAds family are often distributed as popular and harmless applications... The trojans were concealed in a number of tools for optimizing the operation of Android devices, and were distributed under the guise of messengers, multimedia, and other software.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A family of Android banking trojans that remained among the most widespread malware detected on protected Android devices in Q2 2026.
Android banking trojan family that intercepts SMS transaction confirmation codes, displays phishing windows, imitates banking apps, and steals confidential information.
Android banking trojan family targeting mobile devices; activity increased in Q1 2026, with the Mamont subfamily especially widespread.
Android banking trojan family/category referenced as increasing in activity during 2025.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.