In the second quarter of 2026, cybersecurity researchers observed a continued decline in the overall number of attacks on mobile devices, with just under 2 million incidents blocked. Despite this decrease, new and evolving threats, particularly mobile banking Trojans and sophisticated droppers, remained a significant concern for Android and iOS users.
According to telemetry data, 1,996,823 attacks involving malware, adware, or unwanted software were blocked in Q2 2026, down from 2,676,328 in the previous quarter. This downward trend is partly attributed to vendors patching firmware vulnerabilities that previously allowed pre-installed Trojans to proliferate. However, the number of newly discovered malicious Android installation packages remained steady at 304,128.
Mobile banking Trojans continued to dominate the threat landscape, accounting for 30.77% of all detected malicious applications. Researchers identified 93,574 packages related to mobile banking Trojans and 570 related to mobile ransomware Trojans. While the overall volume of new banking Trojan variants decreased sharply, the Creduz family saw a significant increase in its share of identified banking samples. This surge in Creduz builds, despite low victim activity, suggests active development and testing by threat actors.
A notable shift in tactics was observed, with several banking Trojans being reclassified as droppers. This change contributed to a rise in Trojan-Dropper malware, primarily driven by families like Trojan-Dropper.AndroidOS.Banker and Trojan-Dropper.AndroidOS.Mamont. These droppers often serve as initial infection vectors, delivering more potent banking malware to compromised devices.
Researchers also highlighted instances of malicious loaders found directly on Google Play. One such case involved a PDF reader application that, upon execution, presented a fake update request to install the Anatsa banking malware. Another sophisticated loader, detected in the Cleanova app, employed a method to bypass app store reviews by only delivering a malicious payload if telemetry from SDKs indicated the installation originated from specific, targeted sources. If the installation source was outside the threat actor's scope, the malicious logic remained dormant, effectively hiding the malware from scanners.
Among the most frequently detected mobile malware, Backdoor.AndroidOS.Triada.ag topped the list, accounting for 9.35% of unique users attacked. DangerousObject.Multi.Generic and DangerousObject.AndroidOS.GenericML followed with 5.65% and 5.25% respectively. Newer variants of the Mamont banking Trojan, such as Trojan-Banker.AndroidOS.Mamont.hl and Trojan-Banker.AndroidOS.Mamont.iv, saw significant increases in their rankings, indicating ongoing development and deployment by threat actors.
In the adware category, the HiddenAd and MobiDash families experienced sharp declines. Overall, while the total number of mobile attacks decreased, the sophistication and adaptability of threats, particularly banking Trojans and their dropper counterparts, continued to pose a significant challenge to mobile security.
