The third quarter of 2026 saw a notable evolution in mobile threat landscapes, characterized by a decrease in the total volume of attacks alongside an increase in the sophistication of malicious software targeting Android and iOS devices. According to data collected by security researchers, the number of blocked attacks involving mobile malware, adware, and unwanted software fell to approximately 1.67 million, down from nearly 2 million in the previous quarter. Despite this overall decline in volume, the number of unique malicious Android installation packages rose to over 378,000, with banking Trojans emerging as a primary threat.
Artificial intelligence played a significant role in the quarter’s most notable campaigns. In July, researchers identified a malicious Android application masquerading as Google Play Protect that utilized the DistilBERT model to interpret natural-language commands issued from a command-and-control server. Analysts suspect that the server-side instructions for this malware were also generated using large language models. By August, a separate Trojan was discovered that employed on-device AI to scan device galleries for sensitive financial data, such as credit card CVV codes, by classifying images locally. This malware featured a modular design, allowing attackers to update the AI model to expand the scope of their data theft.
Banking Trojans remained a dominant force in the mobile sector, accounting for over 31% of all detected malicious applications. The Mamont and Creduz families were particularly prevalent, with a surge in Trojan-Dropper applications designed to deliver these banking threats. Additionally, the subscription Trojan known as Trojan.AndroidOS.Subscriber.bh reappeared on the Google Play Store, disguised as a keyboard customization tool. This malware utilized a hidden WebView to initiate unauthorized subscriptions and intercepted confirmation messages to finalize the fraudulent transactions, with a specific focus on users in Thailand.
The iOS ecosystem faced its own set of challenges, particularly through the use of the DarkSword exploit kit. In August, researchers identified 13 compromised PHP packages within the Packagist repository that injected links to fraudulent casinos into websites. When accessed via iOS devices, these sites triggered the DarkSword exploit to deploy spyware capable of exfiltrating keychain data, Wi-Fi passwords, SMS messages, and photos. A similar exploit chain was linked to a malicious application named FomoPeek, which had been distributed through the official App Store under the guise of a cryptocurrency wallet tracker.
Other iOS-related threats involved the distribution of modified, malicious versions of popular applications via Telegram. To bypass standard installation restrictions, attackers required users to purchase developer certificates. Once installed, these modified apps collected device metadata and captured screenshots, transmitting the data to external servers.
In the broader Android threat landscape, the Trojan-Proxy.AndroidOS.Vo1d family emerged as a significant concern. These applications, often delivered by preinstalled Trojans, convert infected devices into exit nodes for VPN services. This activity not only consumes the user’s data plan but also allows cybercriminals to route malicious traffic through the victim’s device, potentially implicating the user in illegal online activities. While adware remains the most frequent category of unwanted software encountered by users, its overall impact has continued to decline throughout the quarter.
