Q3 2026 mobile threats: banking Trojan droppers, AI-assisted Android malware and DarkSword iOS campaigns
Kaspersky's Q3 2026 mobile report, based on Kaspersky Security Network detections, counts more than 1.66 million blocked attacks involving mobile malware, adware or unwanted software, down from 1,996,823 in Q2. Trojan-Banker remained the top category at 31.63% of detected malicious apps, and Android malware samples grew to 378,456. The report describes AI-assisted Android samples, a Trojan.AndroidOS.Subscriber.bh subscription Trojan back on Google Play that mainly targeted Thailand, and several iOS campaigns. The most serious iOS activity involves 13 infected PHP packages on Packagist that injected a hidden iframe loading the DarkSword exploit kit on iOS devices only, delivering a spyware module. For defenders the risk is medium: this is a quarterly statistical review, the report names no CVE, and several campaigns depend on users installing apps or accepting a developer certificate.
Detalhes técnicos
- Trojan-Dropper detections rose sharply because droppers repackage known banking Trojans such as Mamont and Creduz. Standalone banking Trojans still rank first and, together with droppers, exceed half of detected malicious apps.
- A Brazil-targeted app disguised as Google Play Protect used a DistilBERT model to interpret natural-language commands from its C2 server. Traces suggest the server-side commands may have been generated by a large language model.
- An August Trojan scanned gallery images and took screenshots to find banking data, including CVV codes. It used an on-device AI model that the operators could update to extend its functionality.
- Trojan.AndroidOS.Subscriber.bh returned to Google Play as a keyboard-theme app. It opened a subscription link in a hidden WebView and intercepted the confirmation code message.
- The Packagist campaign's iOS-only iframe loaded DarkSword, which BleepingComputer described as a new exploit kit for iOS devices (bleepingcomputer.com). The delivered spyware stole keychain contents, Wi-Fi passwords, SMS messages, photos and other personal data. Other modules targeted crypto wallet data and seed phrases.
- SlowMist found the same DarkSword chain in FomoPeek, an App Store app posing as a crypto wallet tracker, which targeted notes and crypto wallet apps. Protos reported the app was available on the Apple App Store for about a week (protos.com).
- Infected versions of popular iOS apps were distributed through Telegram. Victims were asked to buy a developer certificate, and the modified apps sent device information and screenshots to a server.
- Trojan-Proxy.AndroidOS.Vo1d.b apps, delivered by preinstalled Trojans, turn infected devices into VPN exit nodes that relay other people's traffic.
Linha do tempo
-
Q3 2026 mobile threats: banking Trojan droppers, AI-assisted Android malware and DarkSword iOS campaigns
ler a análise desta fonte ocultar
Kaspersky's Q3 2026 mobile report, based on Kaspersky Security Network detections, counts more than 1.66 million blocked attacks involving mobile malware, adware or unwanted software, down from 1,996,823 in Q2. Trojan-Banker remained the top category at 31.63% of detected malicious apps, and Android malware samples grew to 378,456. The report describes AI-assisted Android samples, a Trojan.AndroidOS.Subscriber.bh subscription Trojan back on Google Play that mainly targeted Thailand, and several iOS campaigns. The most serious iOS activity involves 13 infected PHP packages on Packagist that injected a hidden iframe loading the DarkSword exploit kit on iOS devices only, delivering a spyware module. For defenders the risk is medium: this is a quarterly statistical review, the report names no CVE, and several campaigns depend on users installing apps or accepting a developer certificate.
Technical Details
- Trojan-Dropper detections rose sharply because droppers repackage known banking Trojans such as Mamont and Creduz. Standalone banking Trojans still rank first and, together with droppers, exceed half of detected malicious apps.
- A Brazil-targeted app disguised as Google Play Protect used a DistilBERT model to interpret natural-language commands from its C2 server. Traces suggest the server-side commands may have been generated by a large language model.
- An August Trojan scanned gallery images and took screenshots to find banking data, including CVV codes. It used an on-device AI model that the operators could update to extend its functionality.
- Trojan.AndroidOS.Subscriber.bh returned to Google Play as a keyboard-theme app. It opened a subscription link in a hidden WebView and intercepted the confirmation code message.
- The Packagist campaign's iOS-only iframe loaded DarkSword, which BleepingComputer described as a new exploit kit for iOS devices (bleepingcomputer.com). The delivered spyware stole keychain contents, Wi-Fi passwords, SMS messages, photos and other personal data. Other modules targeted crypto wallet data and seed phrases.
- SlowMist found the same DarkSword chain in FomoPeek, an App Store app posing as a crypto wallet tracker, which targeted notes and crypto wallet apps. Protos reported the app was available on the Apple App Store for about a week (protos.com).
- Infected versions of popular iOS apps were distributed through Telegram. Victims were asked to buy a developer certificate, and the modified apps sent device information and screenshots to a server.
- Trojan-Proxy.AndroidOS.Vo1d.b apps, delivered by preinstalled Trojans, turn infected devices into VPN exit nodes that relay other people's traffic.