Chapter 01
Background
Android is a mobile operating system developed by Google, based on a modified version of the Linux kernel and other open-source software. It is the dominant OS for a wide array of devices including smartphones, tablets, televisions (Android TV), and automotive systems (Android Auto).
As of mid-2026, Android accounts for roughly 68–69% of worldwide mobile operating system usage, serving an estimated 3.9 billion users. Its reach is even greater in key growth markets: in countries such as India, Brazil, Indonesia, Vietnam, and Turkey, Android's share exceeds 85%. Google released Android 17 on June 16, 2026, yet adoption of any single release remains gradual — Android 16, the most widely used version, represented only about a quarter of Android traffic worldwide in June 2026 — so the installed base continues to be spread across many OS generations and patch levels. This scale and diversity keep the Android ecosystem a uniquely attractive target for cybercriminals.
Kaspersky's quarterly telemetry offers a useful reference point for the current threat landscape. In the second quarter of 2026, more than 304,000 malicious installation packages were detected, a volume that remained steady compared with the previous quarter. At the same time, the number of attacks blocked on devices declined to about 2.0 million, from 2.7 million in Q1. The picture is therefore one of stable malware production alongside continuous adaptation, rather than of simple growth or decline.
Banking Trojans Remain the Leading Category
Trojan-Banker was the most prevalent category of mobile malware in Q2 2026, accounting for about 31% of detected applications, including more than 93,500 banking Trojan packages. This follows a strong 2025, in which Kaspersky recorded a 56% year-over-year increase in banking Trojan attacks on Android and roughly 255,000 new banking Trojan packages. The Mamont family continues to dominate real-world attack metrics, with newer variants steadily replacing older ones — a sign of active, ongoing development. Meanwhile, the growing share of Creduz builds among newly identified samples, despite modest victim telemetry, suggests that operators are iterating on new builds ahead of broader campaigns.
Droppers, Loaders and Store-Review Evasion
A notable shift in Q2 2026 was the rising share of users targeted by droppers, driven in part by banking droppers. Several banking Trojans are now distributed in packed form and are therefore classified as droppers, which partly explains the movement between categories. Researchers also found malicious loaders on Google Play, including a trojanized PDF reader that presented a fake update prompt in order to stage the Anatsa banking Trojan. Another loader, found in an app named Cleanova, used SDK telemetry about the installation source and returned a payload only to selected targets, remaining dormant elsewhere and thereby avoiding app store scanners. Such techniques make static review of an app at publication time less informative on its own, and highlight the value of behavioral and on-device protection.
Pre-installed and Supply-Chain Threats
Backdoors embedded in device firmware, such as Triada and Keenadu, continue to appear in telemetry; a Triada variant was again the most frequently detected malware type in Q2 2026. On a more encouraging note, Kaspersky observed a decline in attacks driven by certain pre-installed strains, a shift likely linked to the rollout of patched vendor firmware. Because these threats ship with the device itself, they are generally removable only by reflashing a clean firmware image.
Spyware and Data Theft
Spyware families also featured in the quarter's rankings, with Trojan-Spy.AndroidOS.Btmob.e appearing in the top 20 for the first time. Once installed, such tools exfiltrate contacts, messages, photos and other personal data, which may subsequently be used for fraud, account takeover or extortion.
Platform and Policy Developments
On the platform side, Google's Android developer verification program entered its first enforcement phase on September 30, 2026. In Brazil, Indonesia, Singapore and Thailand, apps installed on certified Android devices must now come from developers registered with Google, with an advanced installation flow retained for power users; a broader global roll-out is planned for 2027. Google has described the initiative as a response to malware spread through unofficial APK distribution, and it has also reported that Google Play Protect identified more than 27 million malicious sideloaded apps in 2025. Even so, dedicated security applications remain an important additional layer, particularly on older devices and in markets where apps are commonly obtained from multiple sources.
To protect users from this evolving threat landscape, dedicated Android security applications must be continuously evaluated against real-world threats. This test is designed to independently assess the efficiency of consumer security solutions for the Android OS.
Sources: Kaspersky Securelist, “IT threat evolution in Q2 2026. Mobile statistics” (10 Aug 2026) and “Mobile malware evolution in 2025” (Mar 2026); StatCounter Global Stats (mobile OS and Android version share, Jun–Sep 2026); Google Android developer verification documentation and Google Security Blog; Android 17 release information.
