Chapter 01
Background
Android, Google's mobile operating system built on a modified Linux kernel, remains the world's dominant computing platform — spanning phones, tablets, Android TV, and Android Auto.
Android holds roughly 72% of the global mobile OS market and powers close to 3.9 billion active devices, with penetration above 85% in large emerging markets such as India, Brazil, Indonesia, and Turkey. That scale, combined with device fragmentation and open sideloading, keeps the platform the single most attractive target for mobile-focused cybercrime.
Kaspersky's telemetry for Q1 2026 shows the shift clearly: banking trojans alone made up 52.96% of all detected malicious Android packages, out of more than 306,000 malicious installers identified in the quarter — continuing the roughly 50% quarter-on-quarter growth seen at the end of 2025. Attackers are moving past opportunistic malware toward organized, multi-stage fraud pipelines built to exploit user trust at scale.
Financial Fraud via Advanced Malware
Banking trojans remain the single largest category of Android threats. Dr.Web's Q2 2026 telemetry still ranks Android.Banker as the most widespread family despite a quarter-on-quarter dip, accounting for close to a quarter of all malware detections, while Zimperium's 2026 Banking Heist Report puts the year-over-year rise in malware-driven fraudulent transactions at 67%. Modern variants combine overlay screens that mimic legitimate banking apps with app-virtualization and Accessibility Service abuse to capture credentials and one-time passcodes undetected.
NFC Relay and Contactless Payment Theft
NFC-based fraud has moved from a niche technique to a fast-growing mainstream threat, with relay attacks on smartphones reported to have surged 188% in 2026. Malware built on frameworks such as NFCGate now supports both "direct" schemes, where victims are tricked into tapping a card to an infected phone, and the newer "reverse" scheme, where the infected device is set as the victim's own payment method and used to cash out through ATMs. Trojans like RatOn pair this NFC relay capability with full remote-access and automated-transfer functions, making the fraud difficult to distinguish from a legitimate transaction.
Smishing as a Primary Delivery Vector
SMS-based phishing is now a leading initial-access vector on mobile, accounting for roughly 35% of all phishing activity and contributing, together with vishing, to close to a fifth of all breaches. Messages disguised as delivery notifications, tax refunds, or bank alerts continue to be the most effective lure, driving installs of spyware and banking trojans that bypass the scrutiny users apply to email.
Data Espionage and Extortion
Spyware remains a persistent, high-impact threat category, with detections continuing to climb through 2025 and into 2026. Once installed, these tools quietly exfiltrate contact lists, photos, private messages, and location data, monetizing it through blackmail, identity theft, or resale on darknet markets.
AI-Assisted and System-Level Attacks
AI-assisted malware generation is now an established part of the threat landscape, helping attackers produce variants that slip past signature-based detection. Abuse of Android's Accessibility Services remains a favored escalation path: once granted, it lets malware automate fraudulent transactions, harvest credentials across other apps, and disable security software outright. Google reports that Play Protect flagged 27 million malicious sideloaded apps in 2025, more than double the prior year, underscoring how much of the threat still arrives outside the official store.
Device fragmentation compounds all of the above: a substantial share of the active Android install base still runs versions that no longer receive security patches, and counterfeit or pre-loaded devices remain a persistent supply-chain risk in some markets. Against this backdrop, continuous, independent evaluation of consumer security solutions is essential — which is the purpose of this test.
