Android threats in 2025: When your phone becomes the main attack surface

Android users spent 2025 navigating a sharper attack surface, with malware, data‑stealing apps, and SMS‑based scams all climbing, while attackers refined mobile data and access monetisation. According to Malwarebytes, adware detections nearly doubled in the 2025 December–May versus June–November period, rising by about 90%, with potentially unwanted programs up by roughly two‑thirds and malware up by around half.

The report highlights a shift from nuisance apps to coordinated, well‑structured attack frameworks, driven in part by a surge in SMS‑based campaigns and banking trojans that enable on‑device fraud and account takeover. It notes that MobiDash, a long‑standing Android adware family, continued to appear in detections, and that threats are increasingly delivered through layered toolkits that combine droppers, spying modules and banking payloads.

Triada, a persistent RAT, also ramped up in the second half of 2025, illustrating how legacy mobile tools are feeding newer fraud kits. For users, the guidance remains to exercise caution with permissions, avoid sideloading, and run up‑to‑date real‑time mobile security software.