Loading story…
Kaspersky reported that Android attacks involving malware, adware, and unwanted software fell to 1,996,823 in Q2 2026 from 2,676,328 in the previous quarter, but banking malware remained the leading threat. Trojan-Banker detections accounted for 30.77% of malicious applications, and researchers identified more than 304,000 malicious installation packages, including 93,574 mobile banking Trojan packages and 570 mobile ransomware packages. The report also noted that some banking Trojans were reclassified as droppers as attackers increasingly packed payloads, contributing to growth in Trojan-Dropper detections.
The quarter’s most notable campaigns included malicious loaders distributed through Google Play. Researchers said a trojanized PDF reader was used to deliver the Anatsa banking Trojan, while the Cleanova app relied on SDK telemetry to selectively activate malicious functionality and evade app store review. Kaspersky also said Triada variants remained prominent, Mamont banking Trojan variants rose sharply and appear to be under active development, and attacks tied to some pre-installed Trojans declined, likely because vendors patched affected firmware.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Kaspersky said the Creduz malware family significantly increased its share among identified banking malware samples in Q2 2026. The report assessed that this growth likely reflected active malware iteration, feature testing, or bypass development ahead of a broader campaign.
Kaspersky reported that Trojan-Dropper detections increased in Q2 2026, driven mainly by banking droppers such as Trojan-Dropper.AndroidOS.Banker and Trojan-Dropper.AndroidOS.Mamont. It also said some banking Trojans were reclassified as droppers because attackers increasingly packed them, while newer Mamont variants displaced older ones.
The report noted a downward trend in attacks linked to certain pre-installed Trojan strains in Q2 2026, which Kaspersky attributed likely to patched vendor firmware. HiddenAd and MobiDash adware families also showed sharp declines.
Kaspersky said its Q2 2026 telemetry uncovered multiple malicious loaders hosted on Google Play, including a trojanized PDF reader that staged the Anatsa banking Trojan and the Cleanova app. Cleanova used SDK-derived installation-source telemetry to selectively activate malicious payloads and evade app store review.
In Q2 2026, Kaspersky discovered 304,128 Android malware samples, including 93,574 mobile banking Trojan packages and 570 mobile ransomware packages. Trojan-Banker was the leading mobile malware category, accounting for 30.77% of detected applications.
Kaspersky reported that it blocked 1,996,823 attacks involving malware, adware, or unwanted mobile software on mobile devices during Q2 2026, down from the previous quarter. The figures were based on Kaspersky Security Network telemetry from consenting users.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcemalware.news
Open sourcesecurelist.com
Open sourcekaspersky.ru
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A malicious Android app posing as a document reader on the official Google Play Store delivered the **Anatsa** banking trojan to more than **10,000 users** before removal. Researchers said the app used a dropper technique to evade **Google Play Protect**, fetching its malicious payload only after installation. Once deployed, Anatsa abused **Android Accessibility Services**, watched for targeted banking apps, and launched overlay screens to steal credentials, sensitive input, and multi-factor authentication codes. The malware allowed operators to initiate fraudulent transactions directly from infected devices, making activity appear more trustworthy to banks because it originated from a victim's normal device context. Reporting on the campaign said Anatsa continues to evolve to bypass traditional defenses by hiding inside legitimate-looking apps and abusing trusted mobile workflows, underscoring the risk to Android banking users and the need for tighter app controls, minimal permissions, and behavior-based monitoring.
Jun 29, 2026
Researchers reported two Android banking malware campaigns using staged droppers to evade detection and steal financial data from mobile users. Zscaler ThreatLabz said a fake **Document Reader** app on Google Play was downloaded more than 10,000 times before removal and later fetched the **Anatsa** payload from a remote server, while CYFIRMA identified **KYCShadow** being distributed through fake KYC verification apps sent over WhatsApp to bank customers in India. In both cases, the initial apps appeared legitimate, then installed secondary malicious components designed to bypass early screening and analysis. Once deployed, the malware sought high-risk permissions to hijack accounts, intercept SMS-based one-time passwords, and overlay banking apps to capture credentials. Anatsa was reported to target more than **831 financial institutions** globally, including banks and cryptocurrency platforms, using obfuscation and anti-analysis techniques, while KYCShadow collected data such as mobile numbers, Aadhaar details, ATM PINs, and card information, then used Firebase Cloud Messaging and a full-tunnel VPN for command-and-control and traffic redirection. Researchers urged users to uninstall suspicious apps and avoid software delivered through messaging platforms, and advised defenders to monitor indicators including `jsonapi[.]biz`, `jsonserv[.]biz`, and `jsonserv[.]xyz`.
Jun 29, 2026
Reporting on mobile threats in 2025 highlighted sustained, high-volume malicious activity against Android devices, with **adware** dominating detections and a large number of **mobile banking Trojans** observed in the wild. Kaspersky’s telemetry-based review cited **14,059,465** blocked attacks involving malware/adware/unwanted software during 2025, **62%** of detections attributed to adware, and **815,000+** malicious installation packages identified, including **255,000** mobile banking Trojan packages; it also noted discovery of notable threats such as the **Keenadu** preinstalled backdoor, reportedly injected at the manufacturing stage by modifying `libandroid_runtime.so` to load into the address space of apps. Separate analysis of the Android **Massiv** malware described an active **mobile banking fraud** campaign delivered via a trojanized **IPTV app**, emphasizing the risk from apps sourced outside official stores. Massiv was reported to request extensive permissions and use **overlay** techniques to capture credentials and manipulate banking sessions, including monitoring user interactions and enabling fraudulent transactions with limited user visibility—reinforcing that mobile banking threats remain a material subset of the broader mobile malware ecosystem described in 2025 trend reporting.
Jun 29, 2026