Android.Banker

Android.Banker is an Android banking trojan family reported by Dr.Web as one of the most widespread mobile banking malware families, with activity increasing significantly through Q4 2025 and Q1 2026. Dr.Web stated that Android.Banker detections increased by 65.52% in Q4 2025 and by more than 2.5 times over the following three months, becoming the most widespread Android threat in Q1 2026. The Android.Banker.Mamont subfamily was identified as the most widespread variant during that period.

Its core capabilities include intercepting SMS messages containing one-time banking transaction confirmation codes, displaying phishing windows, and imitating legitimate banking applications in order to steal confidential data and gain illegal access to victims’ banking accounts. The malware targets Android devices and is associated in the reporting with mobile banking fraud rather than a specifically named threat actor.

Dr.Web also reported that threat actors increasingly used Android app modification and obfuscation tooling to help banking trojans evade detection, including junk-code insertion detected as Tool.Obfuscator.TrashCode and NP Manager modifications detected as Tool.NPMod. No specific infection vector unique to Android.Banker was provided in the content beyond its presence on Android devices and the broader use of modified/obfuscated apps. No malware-specific IOCs such as hashes, domains, package names, or C2 infrastructure were provided in the content.