Fast Facts
- Android Trojans used AI to interpret fraud commands and identify banking data in gallery images and screenshots.
- Banking Trojans and droppers surged; Mamont was especially active, while a Google Play subscription Trojan stole confirmation codes.
- iOS attacks used DarkSword to steal keychain data, passwords, messages, photos, and crypto-wallet secrets.
Threat, attack techniques, and targets
- Kaspersky products blocked 1,668,368 attacks involving mobile malware, adware, or unwanted software in Q3 2026. Android banking Trojans remained a major threat, with 119,688 malicious banking Trojan packages among 378,456 detected Android malware samples.
- Attackers targeted Brazilian users with an app that imitated Google Play Protect. The app used an AI model to interpret commands from a command and control server. In another Android campaign, a Trojan analyzed gallery images and screenshots for banking data, including CVV codes.
- Meanwhile, a subscription Trojan reached Google Play disguised as a keyboard theme app. It opened a subscription link in a hidden WebView and intercepted the confirmation code. Scammers mainly targeted users in Thailand.
- iOS threats used several routes. Infected PHP packages injected fraudulent casino links into affected websites and loaded the DarkSword exploit kit on iOS devices. A fake crypto wallet tracker called FomoPeek also used this exploit chain. Additionally, attackers distributed modified iOS apps through Telegram and asked users to buy a developer certificate.
Impact, security implications, and remediation
- The Android campaigns could expose banking data or trigger unwanted subscriptions. The iOS spyware could steal keychain contents, WiFi passwords, messages, photos, notes, and crypto wallet data, including recovery seed phrases.
- Some Android proxy Trojans turned infected devices into VPN exit nodes. As a result, they could consume users’ internet data and let criminals route activity through victims’ devices. This could create legal risks for victims.
- Supply chain compromises and deceptive apps create risks for users of affected websites and mobile apps. However, the report does not provide specific remediation steps. Obtain remediation guidance from the relevant software vendor or authority.
Continue Your Tech Journey
Explore the future of technology with our detailed insights on Artificial Intelligence.
Explore past and present digital transformations on the Internet Archive.
ThreatIntel-V1
