IT threat evolution in Q2 2025. Mobile statistics

According to Kaspersky Security Network, in Q2 2025 our solutions blocked 10.71 million malware, adware, and unwanted mobile software attacks. Trojans were the most common mobile threat, accounting for 31.69% of total detected threats, while just under 143,000 malicious installation packages were detected, including 42,220 mobile banking Trojans and 695 packages that were mobile ransomware Trojans.

The Fakemoney family remained prominent but decreased in activity, while the Mamont banking Trojan family continued to dominate in both installation packages (57.7% of such traffic) and affected users. A new Android and iOS stealer dubbed SparkKitty emerged, linked to SparkCat, and a Trojan named Trojan-DDoS.AndroidOS[.]Agent.a was discovered embedded in apps for viewing adult content to enable configurable DDoS attacks.

The report also notes Trojan-Spy.AndroidOS[.]OtpSteal.a, a fake VPN client that intercepts OTP codes and forwards them to attackers’ Telegram, highlighting continued risks from data-exfiltration and credential-theft tools on mobile devices.