Kaspersky: mobile attacks fell in Q3 as banking Trojans led
Original title: IT threat evolution in Q3 2026. Mobile statistics
Blocked attacks fell to 1,668,368, while 378,456 malicious packages included 119,688 mobile banking Trojans.
Kaspersky's Q3 2026 mobile report says attacks involving malware, adware or unwanted software declined from 1,996,823 in Q2, even as detected Android packages rose. Banking Trojans made up 31.63% of detected malicious apps. Notable cases include a fake Google Play Protect app using DistilBERT, an image-classifying banker, Subscriber.bh on Google Play, and DarkSword activity against iOS through infected Packagist packages and a fake App Store app.
Unconfirmed: Kaspersky says traces suggest C2 commands may have been generated by an LLM, but does not confirm it.
- Backdoor.AndroidOS.Triada.ag led named malware at 13.14% of attacked users.
- Dropper growth was linked to packaged Mamont and Creduz banking Trojans.
- DarkSword modules stole keychain data, Wi-Fi passwords, SMS, photos and wallet seeds.
- Subscriber.bh mainly targeted users in Thailand, according to Kaspersky.
- Modified iOS apps spread through Telegram required users to buy a developer certificate.
Impact: Stolen banking data, messages, photos, keychain contents and wallet seeds
- AI models
- DistilBERT
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | trojan.androidos.fakeapp.in | 2.16 +2.16 Trojan-Spy.AndroidOS.Btmob.c 1.02 2.09 +1.07 +22 Trojan.AndroidOS.Fakeapp.in 0.00 2.03 +2.03 Trojan-Dropper.AndroidOS.Mamont.aq 0.00 2.0 |
| domain | trojan-banker.androidos.agent.ws | +0.23 +2 Trojan-Spy.AndroidOS.GGtrack.a 1.20 1.65 +0.45 +8 Trojan-Banker.AndroidOS.Agent.ws 1.11 1.46 +0.34 +10 Trojan-Dropper.AndroidOS.BeatBanker.c 1 |
From the original article
5 min read at securelist.com
Q3 2026 mobile threat statistics for Android malware, adware, and unwanted software, plus the most notable malware found during the quarter.
By Anton Kivva · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.