Mobile Banking Malware and Broader Mobile Threat Trends in 2025

Reporting on mobile threats in 2025 highlighted sustained, high-volume malicious activity against Android devices, with adware dominating detections and a large number of mobile banking Trojans observed in the wild. Kaspersky’s telemetry-based review cited 14,059,465 blocked attacks involving malware/adware/unwanted software during 2025, 62% of detections attributed to adware, and 815,000+ malicious installation packages identified, including 255,000 mobile banking Trojan packages; it also noted discovery of notable threats such as the Keenadu preinstalled backdoor, reportedly injected at the manufacturing stage by modifying libandroid_runtime.so to load into the address space of apps.

Separate analysis of the Android Massiv malware described an active mobile banking fraud campaign delivered via a trojanized IPTV app, emphasizing the risk from apps sourced outside official stores. Massiv was reported to request extensive permissions and use overlay techniques to capture credentials and manipulate banking sessions, including monitoring user interactions and enabling fraudulent transactions with limited user visibility—reinforcing that mobile banking threats remain a material subset of the broader mobile malware ecosystem described in 2025 trend reporting.