Q3 2026 Mobile Malware Surges, Featuring AI-Powered Fraud and iOS Exploits

Kaspersky's latest threat intelligence report for Q3 2026 highlights a concerning surge in mobile malware, with over 1.66 million attacks successfully blocked by their security products. The report indicates a shift towards more sophisticated attack vectors, particularly those leveraging artificial intelligence to automate fraudulent activities and steal sensitive banking data. Trojan-Banker variants emerged as the most prevalent threat, accounting for a substantial 31.63% of all detected malicious applications.

The report details a particularly alarming malicious Android application that masqueraded as Google Play Protect. This app utilized the DistilBERT model to interpret natural language commands from its command-and-control (C2) server, with evidence suggesting that these commands may have been generated by large language models (LLMs). This AI-driven automation allowed for more dynamic and evasive fraudulent operations. Another notable Android threat involved a Trojan that employed an on-device AI model to analyze images from the device's gallery and take screenshots, specifically searching for banking information such as CVV codes. The malware's ability to update its AI model remotely provided attackers with a flexible mechanism to expand its capabilities.

Beyond AI-driven fraud, the quarter also saw the return of a subscription Trojan, disguised as a keyboard theme app, to Google Play. This malicious application exploited a hidden WebView to open subscription links and intercept confirmation codes, primarily targeting users in Thailand. The report also noted a decline in overall mobile malware attacks compared to the previous quarter, dropping to approximately 1.66 million from 1.99 million, though the number of detected Android malware samples increased to 378,456.

Attacks on iOS users were also prominent, with threat actors exploiting vulnerabilities in the PHP ecosystem. Researchers discovered 13 infected PHP packages in the Packagist repository that injected links to fraudulent casinos. Crucially, on iOS devices, these packages delivered the DarkSword exploit kit, which was capable of stealing sensitive data including keychain contents, Wi-Fi passwords, SMS messages, and photos. Further modules within this campaign were designed to exfiltrate cryptocurrency wallet data and seed phrases.

The DarkSword exploit chain was also identified by SlowMist researchers in a fake app called FomoPeek, which was available on the App Store and presented itself as a cryptocurrency wallet tracker. This malware specifically targeted data stored in notes and crypto wallet applications. Additionally, modified versions of popular iOS applications were distributed via Telegram, requiring users to purchase developer certificates. These compromised apps contained malicious modules that collected device information, captured screenshots, and transmitted this data to attacker-controlled servers.

The statistics section of the report highlighted a growing trend in Trojan-Dropper applications, which are used to deliver known banking Trojans like Mamont and Creduz. This rise in droppers correlates with the observed trend of attackers "packaging" banking Trojans. Standalone banking Trojans, however, still represent the largest category of malicious apps, with droppers and banking Trojans combined accounting for over half of all detected malicious applications.

While adware attacks saw a decline, contributing to the overall drop in mobile threats, other categories like Trojan-Spy attacks experienced growth. The BTMOB and SpyNote RAT Trojans were identified as significant contributors to this increase, being actively used for financial theft. The report underscores a dynamic and evolving mobile threat landscape, where AI is increasingly integrated into both the development and execution of malware, posing significant challenges for mobile security.