Android Malware Detection Test — Enterprise Products | April 2026

Chapter 01

Background

Android is a mobile operating system developed by Google, based on a modified version of the Linux kernel and other open-source software. It is the dominant OS for a wide array of devices including smartphones, tablets, televisions (Android TV), and automotive systems (Android Auto).

As of early 2026, Android commands approximately 72.5% of the global mobile operating system market, powering an estimated 3.9 billion active devices worldwide. Its dominance is even more pronounced in key emerging markets — in countries such as India, Brazil, Indonesia, and Turkey, Android's market share exceeds 85%. The proliferation of Android devices in enterprise environments — from mobile workforce deployments to BYOD policies — makes endpoint security for Android a critical component of any modern enterprise security strategy.

The threat landscape heading into 2026 has matured significantly. Android devices now account for 94% of all mobile-specific malware detections globally. Enterprise environments face a distinct and elevated risk profile: a single compromised device can serve as an entry point to corporate networks, VPNs, email systems, and cloud services, enabling lateral movement and data exfiltration at scale.

Financial Fraud via Advanced Malware

Banking trojans continue to dominate the mobile threat landscape. Attacks from families such as Android.Banker increased by over 150% in Q1 2025, and Kaspersky reported a 48% rise in Android attacks compared to the second half of 2024. In enterprise contexts, these threats target corporate banking credentials and payment authorizations, posing direct financial risk.

Corporate Espionage and Data Exfiltration

Spyware incidents rose by 147% in 2025. Once deployed on an enterprise device, advanced spyware can silently exfiltrate email archives, document stores, contact lists, calendar data, and real-time location information. Nation-state threat actors and organized criminal groups have increasingly targeted Android endpoints as a lower-friction path into enterprise infrastructure compared to hardened desktop environments.

NFC Relay and Contactless Payment Threats

Android NFC malware incidents rose approximately 87% year-over-year in 2025. Strains such as RatON combine NFC relay attacks with remote access trojans (RATs) and overlay techniques, enabling attackers to capture and relay contactless payment credentials from enterprise devices in real time. RatON was discovered on the Google Play Store in early 2026.

AI-Assisted Evasion and Accessibility Abuse

A key 2026 development is the use of AI tools to generate adaptive malware capable of evading signature-based detection engines. Attackers increasingly abuse Android's Accessibility Services — once granted, these permissions allow malware to automate fraudulent transactions, harvest credentials across any installed application, and disable security software silently, rendering traditional endpoint controls ineffective.

OS fragmentation remains critical: Android 12 and older versions — no longer receiving security patches — collectively account for nearly 30% of the active installed base, including devices in active enterprise deployment. To protect organizations from this highly organized and rapidly evolving threat landscape, enterprise Android security solutions must be continuously and independently evaluated against real-world threats. This test is designed to assess the efficiency of enterprise-grade security solutions for the Android OS.

Chapter 02

Test Process & Test Software

This section outlines the methodology used for the test conducted in April 2026. The test environment and procedures were designed to ensure objectivity and reproducibility.

Test Device

Samsung Galaxy S22

Operating System

Android 14

Malware Samples

1,099 in-the-wild

Clean Applications

499 installers

Test Environment

A Samsung Galaxy S22 was used as the primary testing platform.
The device was running a clean installation of Android 14.
Before each test run, the device was reset to a clean, pre-configured backup image to ensure a consistent state and prevent cross-contamination between tests.

Test Procedure

Sample Collection: A comprehensive test set was compiled, consisting of 1,099 recent, in-the-wild malware samples and 499 legitimate, clean application installers gathered from threat intelligence feeds and verified sources.
Software Installation: Each security application was installed on the test device using its default configuration settings.
Signature Updates: Prior to each scan, each application and its virus definitions were updated to the latest available versions to ensure peak detection capability.
Static Analysis (On-Demand Scan): A full file system scan was initiated. All detections and any false positives were recorded.
Dynamic Analysis (Behavioral Test): Each malicious sample not detected during the static scan was manually installed and executed. Behavioral or on-execution detections were recorded.
False Positive Verification: Clean applications were scanned only — not installed or executed — serving exclusively to measure the false positive rate.

Tested Products — Software & Versions

Vendor	Software	Version
Dr.Web	Dr.Web Mobile Security Suite	12.9.10(2)
ESET	ESET Endpoint Security for Android	v 6.4.10.0-0
Kaspersky	Kaspersky Endpoint Security for Mobile	10.57.1.37
Total Defense	Total Defense Mobile Security	16.4.3
Dr.Web Mobile Security Suite is included in Dr.Web Enterprise Security Suite

Chapter 03

Tested Results

Android Malware Detection Rate — Enterprise Products

April 2026 · Testing Ground Labs · Total Samples: 1,099

ESET

100.00%

100.00

Kaspersky

100.00%

100.00

Total Defense

99.91%

99.91

Dr.Web

99.73%

99.73

Vendor	Total	Missed	Detected	Detection Rate	Final Score
ESET	1099	0	1099	100.00%	100.00
Kaspersky	1099	0	1099	100.00%	100.00
Total Defense	1099	1	1098	99.91%	99.91
Dr.Web	1099	3	1096	99.73%	99.73

For each security solution, a Final Score is calculated once the full test is performed:

Final Score = (Detection %) × 100 − 0.2 × FP

Final Score	Monthly Award
98.00 – 100.00	★★★★★ 5-star rating
95.00 – 97.99	★★★★ 4-star rating
90.00 – 94.99	★★★ 3-star rating

Chapter 05

Compliance

This test was made in accordance with the requirements of the AMTSO Testing Protocol Standard v.1.3 (https://www.amtso.org/standards/) and is confirmed by AMTSO as compliant with the Standard.

Chapter 06

Rights Statement

Unless otherwise stated, Testing Ground Labs (hereinafter referred to as "TG Labs"), owns the copyright of this report. Without prior written consent of TG Labs, no other organization or individual shall have the right to alter the contents of this report and use it for commercial purposes by any means (including but not limited to transmission, dissemination, reproduction, excerpt, etc.).

Unless otherwise stated, TG Labs shall be the rightful owner of the trademarks and service marks used in the report. Any action of infringing upon the legal rights of TG Labs is prohibited. TG Labs shall have the right to pursue the legal liability of the infringer in accordance with the law.

Chapter 07

Disclaimer

Before using this report issued by Testing Ground Labs (hereinafter "TG Labs"), please read and understand the following terms and conditions (the "Disclaimer") carefully, including provisions that limit or exclude TG Labs' liability and that restrict the rights of users. Use of this report constitutes acceptance of, and agreement to, all terms and conditions set forth herein.

The report is provided by TG Labs; all contents are provided for reference purposes only and shall not be construed as a recommendation, invitation, or warranty to choose, purchase, or use any products mentioned herein. TG Labs does not guarantee the absolute accuracy or completeness of the report's contents; readers should not rely solely on this report or substitute its findings for their own independent judgment.
The contents contained herein is the judgment made by TG Labs to the product characteristics as of the date the report was published. TG Labs reserves the right to issue future reports containing different content or conclusions and is under no obligation to update this report or notify readers of any such updates.
The report may contain links to other websites provided solely for the readers' convenience. The contents of linked websites are not part of this report. TG Labs accepts no liability, direct or indirect, for any damages or losses arising from readers' access to or reliance on such linked websites.
TG Labs may have existing or future business relationships with companies whose products are mentioned in this report, but is under no obligation to disclose such relationships to readers.
Receipt of this report does not constitute the formation of any business or client relationship between the reader and TG Labs. TG Labs does not accept any legal liability as the readers' customer.
All products tested by TG Labs were procured through official and lawful channels. The findings of this report apply only to products obtained through equivalent channels, and not to products acquired through unofficial or unlawful means.
This report may reference trademarks, images, or intellectual property owned by third parties. If you believe your rights have been infringed, please contact TG Labs promptly.

TG Labs reserves the right to interpret, amend, and update this Disclaimer at any time.

Android Malware
Detection Test

Table of Contents