“More than 1.66 million attacks involving mobile malware, adware, or unwanted software were blocked.” Kaspersky’s quarterly figures for Q3 2026 make that blunt number the opening fact: the firm’s telemetry shows both a continuing decline in total blocked mobile incidents and a shift in the composition and sophistication of those threats.
Q3 2026 in numbers: volumes down, banking threats up
According to Kaspersky Security Network, the total number of mobile attacks fell to 1,668,368 in Q3 from 1,996,823 in Q2. At the same time, Kaspersky detected 378,456 Android malware samples and more than 378,000 malicious installation packages overall, including 119,688 mobile banking Trojan packages. The Trojan-Banker category was the prevalent mobile malware threat, accounting for 31.63% of all detected malicious apps in the quarter.
Adware attacks decreased and contributed to the overall drop in incidents, but the composition shifted toward more packaged and modular threats. Kaspersky notes a sharp rise in Trojan-Dropper apps—largely because attackers are “packaging” banking Trojans into droppers—while standalone banking Trojans and droppers together still represent more than half of detected malicious apps.
Malicious app imitating Google Play Protect — DistilBERT and hints of LLMs
In July, Kaspersky researchers discovered a malicious Android app targeting Brazilian users that impersonated Google Play Protect. The app’s code included the DistilBERT model to interpret natural-language commands received from a command-and-control server. Traces left in the code “suggest the server-side commands may also have been generated by a large language model (LLM),” Kaspersky reports.
The finding is notable because it documents two things in the wild at once: first, on-device use of a transformer model for interpreting commands; second, evidence that server-side commands may be created or curated with LLM assistance. Kaspersky links this activity specifically to fraud automation conducted under the guise of a familiar device-protection service.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildOn-device AI and image-snooping Trojans
In August, Kaspersky found a Trojan that analyzed images saved in a device’s gallery and took screenshots to search for banking data such as CVV codes. That malware used an on-device AI model to classify images and could update the model, giving attackers a live mechanism to expand capability. The report also highlights a subscription Trojan, detected as Trojan.AndroidOS.Subscriber.bh, which returned to Google Play disguised as a keyboard-theme app; the Trojan opened a subscription link in a hidden WebView and intercepted confirmation codes, with Kaspersky data showing scammers mainly targeted users in Thailand.
Another emergent threat class recorded in Q3 was Trojan-Proxy.AndroidOS.Vo1d.b, a newcomer in the top-20 list. Delivered by preinstalled Trojans, these apps convert infected devices into exit nodes for VPN services—burning victims’ data allowance and exposing victims to being used to relay other people’s traffic or visit banned sites in the victim’s name.
iOS supply-chain and sideloading vectors: Packagist, DarkSword, and FomoPeek
Kaspersky’s Q3 summary details several iOS-targeting campaigns. In August, researchers at Socket found 13 infected PHP packages in the Packagist repository that injected links to fraudulent casinos on affected websites and, on iOS devices only, a hidden iframe that loaded the DarkSword exploit kit. That chain delivered a spyware module designed to steal keychain contents, Wi‑Fi passwords, SMS messages, photos and other personal data, plus modules aimed at stealing crypto wallet data and seed phrases.
SlowMist researchers linked the DarkSword exploit chain to a malicious App Store app called FomoPeek, which presented as a crypto wallet tracker and was designed to harvest notes and data from crypto wallet apps. Kaspersky also observed modified versions of popular iOS apps distributed via Telegram; those versions required users to buy a developer certificate and contained modules that collected device data, took screenshots, and exfiltrated information to remote servers.
What this means for technologists, policymakers, and end users
- Technologists and security teams: expect continued growth of droppers and packaged banking Trojans—Kaspersky ties the Trojan-Dropper rise to increased packaging of known bankers such as Mamont and Creduz—and watch for on-device models and updatable AI components in malware.
- Policymakers and repository maintainers: the Packagist/DarkSword episode underscores supply-chain risk for web and mobile ecosystems and highlights the cross-platform consequences when repository packages are trojanized.
- End users and mobile app store managers: the return of subscription Trojans to Google Play, apps impersonating Play Protect, and the distribution of infected iOS apps via Telegram emphasize that official-store provenance is not an absolute guarantee and that sideloading or unconventional installation steps can be weaponized.
Kaspersky’s Q3 record frames a dual picture: fewer overall mobile incidents, but attackers who remain active are innovating—embedding AI models on devices, packaging bankers into droppers, leveraging app-store and package-repository channels, and targeting both Android and iOS ecosystems. The quarter’s details raise a pointed operational question for defenders and platform operators alike: will detection and distribution controls keep pace with malware that embeds learning models, self-updating components and increasingly sophisticated supply-chain tactics?
https://securelist.com/malware-report-q3-2026-mobile-statistics/121844/
