Chapter 01
Background
Android is a mobile operating system developed by Google, based on a modified version of the Linux kernel and other open-source software. It is the dominant OS for a wide array of devices including smartphones, tablets, televisions (Android TV), and automotive systems (Android Auto).
As of early 2026, Android commands approximately 72.5% of the global mobile operating system market, powering an estimated 3.9 billion active devices worldwide. Its dominance is even more pronounced in key emerging markets — in countries such as India, Brazil, Indonesia, and Turkey, Android's market share exceeds 85%. Global smartphone shipments reached 1.25 billion units in 2025, and while the market faces headwinds from component shortages in 2026, the installed base of Android devices continues to represent the world's largest computing platform. This massive, fragmented user base makes the Android ecosystem a uniquely attractive target for cybercriminals.
The threat landscape heading into 2026 has matured significantly. Android devices now account for 94% of all mobile-specific malware detections globally. Attackers are no longer simply throwing malware at users — they are building ecosystems, coordinating multi-stage fraud pipelines, and exploiting user trust at scale.
Financial Fraud via Advanced Malware
Banking trojans continue to dominate the mobile threat landscape. Attacks from families such as Android.Banker increased by over 150% in Q1 2025, and Kaspersky reported a 48% rise in Android attacks compared to the second half of 2024. These threats use overlay attacks to create fake login screens mimicking legitimate banking apps, and advanced techniques such as app virtualization to capture credentials and one-time passwords without arousing suspicion.
NFC Relay and Contactless Payment Theft
Android NFC malware incidents rose approximately 87% year-over-year in 2025. Newer strains such as RatON combine NFC relay attacks with remote access trojans (RATs) and overlay techniques to automate fraudulent transactions directly from the victim's device — intercepting card data during contactless payment gestures and relaying it to attacker-controlled devices in real time. RatON was discovered on the Google Play Store in early 2026.
Smishing as a Primary Delivery Vector
SMS-based phishing ("smishing") has become a dominant initial attack vector. Between April and May 2025, smishing attacks spiked by an alarming 692%. Users receive deceptive messages disguised as delivery notifications, tax refunds, or bank alerts, leading to the installation of spyware or banking trojans. The FBI and international cybersecurity agencies have since issued coordinated warnings about the scale and sophistication of these campaigns.
Data Espionage and Extortion
Spyware incidents rose by 147% in 2025, with Kaspersky telemetry separately noting a ~51% year-over-year increase in spyware detections. Once deployed, these tools operate silently to exfiltrate personal data — contact lists, photos, private messages, and real-time location — then monetize it through blackmail, identity theft, or darknet markets.
AI-Assisted and System-Level Attacks
A key 2026 development is the use of AI tools to generate adaptive malware that evades signature-based detection. Attackers also abuse Android's Accessibility Services: once granted, these permissions allow malware to automate fraudulent transactions, harvest credentials across any installed app, and disable security software. In 2025, adware volumes nearly doubled, driven by aggressive families like MobiDash, while Banking Trojans and spyware have outpaced traditional nuisances to become the dominant threat category.
OS fragmentation remains critical: Android 12 and older versions — no longer receiving security patches — collectively account for nearly 30% of the active installed base. Supply chain weaknesses persist, with counterfeit devices in some markets arriving pre-loaded with malware. To protect users from this highly organized and rapidly evolving threat landscape, dedicated Android security applications must be continuously evaluated against real-world threats. This test is designed to independently assess the efficiency of consumer security solutions for the Android OS.
