Kaspersky reports more than 1.66 million mobile threat attacks

According to Kaspersky Security Network data, IT threat evolution in Q3 2026 shows mobile-focused malware activity continuing to be tracked and analysed by Kaspersky researchers. More than 1.66 million attacks involving mobile malware, adware, or unwanted software were blocked in Q3 2026, with the Trojan-Banker category remaining the most prevalent mobile threat, accounting for 31.63% of detected malicious apps.

Over 378,000 malicious installation packages were detected, including 119,688 packages belonging to mobile banking Trojans. The quarterly trend also notes a downward overall in attacks on mobile devices, declining to 1,668,368 from 1,996,823 in Q2, driven in part by fewer adware incidents. Android malware samples rose to 378,456.

In the TOP 20 types of mobile malware, Trojan-Proxy[.]AndroidOS.Vo1d.b emerged as a notable newcomer, delivered by preinstalled Trojans and capable of turning devices into VPN exit nodes, a dual risk of data relaying and potentially facilitating attacks on services under the victim’s name.

Kaspersky researchers highlight several notable quarterly highlights. In July, a malicious app impersonating Google Play Protect used AI (DistilBERT, with server-side commands possibly generated by an LLM) to automate fraud for Brazilian users. In August, a Trojan used on-device AI to analyse gallery images and capture banking data, including CVV codes, with on-device model updates.

Also in Q3, the Trojan.AndroidOS.Subscriber[.]bh subscription Trojan resurfaced in Google Play, disguising itself as a keyboard-theme app and levering a hidden WebView to intercept confirmation codes—predominantly targeting Thai users. iOS threats also figure, with Packagist PHP packages delivering a DarkSword-based spyware chain and a separate iOS app‑store poisoning campaign linked to data theft from keychains, messages, and crypto wallets, as reported by Socket and SlowMist researchers.