Kaspersky says Android attackers are shifting to app-store loaders as on-device malware falls
Quarterly KSN telemetry shows on-device malware declining while the most dangerous banking threats increasingly arrive as seemingly legitimate app-store apps that unpack a payload.
Kaspersky's quarterly mobile section of its
The headline is less that mobile malware is disappearing than that it is moving where you don't look. Banking Trojans remained the largest single mobile-malware category at 30.77% of detected applications, and researchers found more than 304,000 malicious installation packages in the quarter — with 93,574 tied to mobile banking Trojans and 570 to mobile ransomware. A notable share of the increase in droppers such as Trojan-Dropper.AndroidOS.Banker and Trojan-Dropper.AndroidOS.Mamont reflects a tactical shift: banking Trojans are now frequently packed and delivered by a separate installer.
The app store is now a delivery vector
The most interesting finding in the report is that multiple malicious loaders were hosted directly on Google Play. In one instance a PDF reader app was trojanized to drop the Anatsa banking malware — it showed users a fake 'install an update' prompt that staged the banking Trojan on the device. In another, a loader inside an app (including one identified in 'Cleanova') sent telemetry and SDK-sourced install metadata back to a command-and-control server, which returned the malicious payload only for apps from certain sources. That is a deliberate way to pass app-store review: the app is benign until the server confirms it came from a distribution channel worth attacking.
- Banking Trojans are the largest mobile-malware category (~30% of detections)
- Dropper-based delivery (Banker, Mamont) is up, classic standalone bankers are down
- Google Play now hosts active malicious loaders, not just accidentally-malicious apps
- Patched vendor firmware has cleared out a wave of pre-installed Trojans
For consumers: if a 'PDF reader' or 'cleaner' app suddenly offers to install an update, treat it as suspicious even if it came from the Play Store. For app developers and security teams: install-source telemetry is now a real attack-signal — knowing where an app was installed is part of the exploit decision, not just an analytics detail.
What this means for you
If you're a regular mobile user: the biggest risk is no longer 'download a .apk from a shady forum' — it's install a perfectly normal app from the Play Store that quietly unpacks a banking Trojan. Check for app-store origin on any app that asks for banking permissions. If you run an Android fleet: pay attention to install-source telemetry in your EDR. An attacker choosing a payload based on distribution channel means the 'source of install' field in your telemetry is now an adversarially observed signal.
Sources: Kaspersky Securelist — Q2 2026 Android threat landscape; Kaspersky ICS CERT — Kaspersky Security Bulletin Archive; Malwarebytes — Android threats in 2025: your phone as the main attack surface.
Corrections: Report an error at corrections@wireshaman.com.