Loading story…
Doctor Web's Q3 2025 review of virus activity on mobile devices revealed that Android.MobiDash ad-displaying trojans were the most prevalent mobile threats, with their detection rate increasing by 18.19% compared to the previous quarter. Android.HiddenAds, which had been the leading threat, saw a significant decline in activity, dropping by 71.85%, but remained the second most common mobile malware. These adware trojans are known for concealing their icons to evade detection and removal, while displaying intrusive ads, including full-screen videos. Android.FakeApp trojans, often used in fraudulent schemes and to load malicious or gambling websites, maintained their position as the third most detected threat, though their activity decreased by 7.49%. Banking trojans such as Android.Banker, despite a 38.88% decline in activity, continued to be the most widespread banking malware, employing tactics like phishing overlays, SMS interception, and mimicking legitimate banking apps to steal credentials and funds. Android.BankBot trojans, which can intercept confirmation codes and execute remote commands, saw an 18.91% increase in detections. Android.SpyMax, based on SpyNote spyware, was also among the top banking trojans, though its activity dropped by 17.25%.
Doctor Web's broader Q3 2025 virus activity review indicated a 4.23% decrease in total threats detected, but a 2.17% increase in unique threats, highlighting the evolving threat landscape. The most common threats included adware, ad-displaying trojans, and malicious scripts, with email traffic dominated by scripts, backdoors, and various trojans such as downloaders and password stealers. Ransomware activity was notable, with Trojan.Encoder.35534, Trojan.Encoder.35209, and Trojan.Encoder.35067 being the most frequently encountered. In July, Doctor Web reported on the Trojan.Scavenger family, which targets cryptocurrency and password theft by masquerading as game mods and exploiting DLL Search Order Hijacking vulnerabilities. August saw the emergence of Android.Backdoor.916.origin, a multifunctional backdoor targeting Russian business representatives, capable of remote control and data theft. That same month, a targeted attack on a Russian engineering enterprise by the Scaly Wolf group was uncovered, utilizing the Updatar modular backdoor to exfiltrate confidential data. The quarter also saw an increase in fake Telegram websites and fraudulent finance-themed online resources, as well as the appearance of dozens of malicious and unwanted apps on Google Play. These findings underscore the persistent and diverse nature of cyber threats facing both mobile and desktop users, with attackers employing increasingly sophisticated methods to evade detection and compromise victims.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On 2026-01-15, Dr.Web published its annual review of virus activity on mobile devices in 2025. This is a new reporting milestone distinct from the earlier Q3 2025 mobile threat report.
On October 1, 2025, Dr.Web published its Q3 2025 review of mobile malware activity, reporting Android.MobiDash as the most prevalent Android threat with detections up 18.19% quarter over quarter. The report also noted major shifts among HiddenAds, FakeApp, Banker, BankBot, and SpyMax detections.
Across Q3 2025, Dr.Web reported that many malicious apps were distributed through Google Play, collectively reaching more than 1,459,000 installations. The apps included dozens of Android.Joker subscription trojans, Android.FakeApp samples, and the fake-earnings app Zeus Jackpot Mania detected as Program.FakeMoney.16.
During Q3 2025, Dr.Web observed a social-engineering campaign distributing the Android.Backdoor.916.origin backdoor through messenger-sent APKs disguised as an antivirus app. The campaign was assessed as targeting representatives of Russian businesses.
3 references tracked. Mallory keeps watching after this page renders.
news.drweb.com
Open sourcenews.drweb.com
Open sourcenews.drweb.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A significant increase in mobile malware activity was observed in Q4 2025, with Doctor Web reporting that adware trojans such as Android.MobiDash and Android.HiddenAds remained the most prevalent threats, though their detection rates declined. Conversely, banking trojans, particularly from the Android.Banker family, saw a 65.52% rise in activity, targeting users by intercepting SMS one-time codes and mimicking legitimate banking apps. The review also highlighted the widespread use of unwanted software like CloudInject, which adds dangerous permissions and obfuscated code to apps, as well as riskware programs modified with NP Manager. Additionally, Doctor Web identified new threats such as the Android.Backdoor.Baohuo.1.origin, distributed via modified Telegram X apps to steal credentials, and the unique Trojan.ChimeraWire, which manipulates website popularity metrics. Globally, India experienced a 38% year-over-year increase in mobile malware attacks, accounting for 26% of all mobile malware traffic worldwide, according to Zscaler. Hundreds of malicious apps, many disguised as productivity tools, infiltrated trusted platforms like the Google Play Store, with over 42 million downloads. Attackers focused on high-value industries, with retail, hospitality, and manufacturing sectors being primary targets. The escalation in Android malware transactions and the strategic targeting of consumer-facing and operations-heavy environments underscore the evolving tactics of threat actors and the growing risks to mobile device users and organizations worldwide.
Jun 29, 2026
Kaspersky reported that Android attacks involving malware, adware, and unwanted software fell to **1,996,823** in Q2 2026 from **2,676,328** in the previous quarter, but banking malware remained the leading threat. **Trojan-Banker** detections accounted for **30.77%** of malicious applications, and researchers identified more than **304,000** malicious installation packages, including **93,574** mobile banking Trojan packages and **570** mobile ransomware packages. The report also noted that some banking Trojans were reclassified as droppers as attackers increasingly packed payloads, contributing to growth in **Trojan-Dropper** detections. The quarter’s most notable campaigns included malicious loaders distributed through **Google Play**. Researchers said a trojanized PDF reader was used to deliver the **Anatsa** banking Trojan, while the **Cleanova** app relied on SDK telemetry to selectively activate malicious functionality and evade app store review. Kaspersky also said **Triada** variants remained prominent, **Mamont** banking Trojan variants rose sharply and appear to be under active development, and attacks tied to some pre-installed Trojans declined, likely because vendors patched affected firmware.
Aug 10, 2026
Reporting on mobile threats in 2025 highlighted sustained, high-volume malicious activity against Android devices, with **adware** dominating detections and a large number of **mobile banking Trojans** observed in the wild. Kaspersky’s telemetry-based review cited **14,059,465** blocked attacks involving malware/adware/unwanted software during 2025, **62%** of detections attributed to adware, and **815,000+** malicious installation packages identified, including **255,000** mobile banking Trojan packages; it also noted discovery of notable threats such as the **Keenadu** preinstalled backdoor, reportedly injected at the manufacturing stage by modifying `libandroid_runtime.so` to load into the address space of apps. Separate analysis of the Android **Massiv** malware described an active **mobile banking fraud** campaign delivered via a trojanized **IPTV app**, emphasizing the risk from apps sourced outside official stores. Massiv was reported to request extensive permissions and use **overlay** techniques to capture credentials and manipulate banking sessions, including monitoring user interactions and enabling fraudulent transactions with limited user visibility—reinforcing that mobile banking threats remain a material subset of the broader mobile malware ecosystem described in 2025 trend reporting.
Jun 29, 2026