Independent assessment of 4 enterprise security solutions against 1,368 real-world Android malware samples.
Android is a mobile operating system developed by Google, based on a modified version of the Linux kernel and other open-source software. It is the dominant OS for a wide array of devices including smartphones, tablets, televisions (Android TV), and automotive systems (Android Auto).
As of mid-2026, Android accounts for roughly 68–69% of worldwide mobile operating system usage, serving an estimated 3.9 billion users. Its reach is even greater in key growth markets: in countries such as India, Brazil, Indonesia, Vietnam, and Turkey, Android's share exceeds 85%. Google released Android 17 on June 16, 2026, yet adoption of any single release remains gradual — Android 16, the most widely used version, represented only about a quarter of Android traffic worldwide in June 2026 — so the installed base continues to be spread across many OS generations and patch levels. This scale and diversity keep the Android ecosystem a uniquely attractive target for cybercriminals.
Kaspersky's quarterly telemetry offers a useful reference point for the current threat landscape. In the second quarter of 2026, more than 304,000 malicious installation packages were detected, a volume that remained steady compared with the previous quarter. At the same time, the number of attacks blocked on devices declined to about 2.0 million, from 2.7 million in Q1. The picture is therefore one of stable malware production alongside continuous adaptation, rather than of simple growth or decline.
Trojan-Banker was the most prevalent category of mobile malware in Q2 2026, accounting for about 31% of detected applications, including more than 93,500 banking Trojan packages. This follows a strong 2025, in which Kaspersky recorded a 56% year-over-year increase in banking Trojan attacks on Android and roughly 255,000 new banking Trojan packages. The Mamont family continues to dominate real-world attack metrics, with newer variants steadily replacing older ones — a sign of active, ongoing development. Meanwhile, the growing share of Creduz builds among newly identified samples, despite modest victim telemetry, suggests that operators are iterating on new builds ahead of broader campaigns.
A notable shift in Q2 2026 was the rising share of users targeted by droppers, driven in part by banking droppers. Several banking Trojans are now distributed in packed form and are therefore classified as droppers, which partly explains the movement between categories. Researchers also found malicious loaders on Google Play, including a trojanized PDF reader that presented a fake update prompt in order to stage the Anatsa banking Trojan. Another loader, found in an app named Cleanova, used SDK telemetry about the installation source and returned a payload only to selected targets, remaining dormant elsewhere and thereby avoiding app store scanners. Such techniques make static review of an app at publication time less informative on its own, and highlight the value of behavioral and on-device protection.
Backdoors embedded in device firmware, such as Triada and Keenadu, continue to appear in telemetry; a Triada variant was again the most frequently detected malware type in Q2 2026. On a more encouraging note, Kaspersky observed a decline in attacks driven by certain pre-installed strains, a shift likely linked to the rollout of patched vendor firmware. Because these threats ship with the device itself, they are generally removable only by reflashing a clean firmware image.
Spyware families also featured in the quarter's rankings, with Trojan-Spy.AndroidOS.Btmob.e appearing in the top 20 for the first time. Once installed, such tools exfiltrate contacts, messages, photos and other personal data, which may subsequently be used for fraud, account takeover or extortion.
On the platform side, Google's Android developer verification program entered its first enforcement phase on September 30, 2026. In Brazil, Indonesia, Singapore and Thailand, apps installed on certified Android devices must now come from developers registered with Google, with an advanced installation flow retained for power users; a broader global roll-out is planned for 2027. Google has described the initiative as a response to malware spread through unofficial APK distribution, and it has also reported that Google Play Protect identified more than 27 million malicious sideloaded apps in 2025. Even so, dedicated security applications remain an important additional layer, particularly on older devices and in markets where apps are commonly obtained from multiple sources.
For organizations, these developments matter in two ways. Managed fleets and BYOD programs frequently include devices on older OS releases or from regional vendors, where firmware patching is slower. And enterprise users are exposed to the same banking, spyware and credential-theft families as consumers — often on devices that also hold corporate email, messaging and identity applications. Mobile endpoint protection is therefore best assessed on the same real-world samples as consumer products.
To protect users from this evolving threat landscape, dedicated Android security applications must be continuously evaluated against real-world threats. This test is designed to independently assess the efficiency of enterprise security solutions for the Android OS.
Sources: Kaspersky Securelist, “IT threat evolution in Q2 2026. Mobile statistics” (10 Aug 2026) and “Mobile malware evolution in 2025” (Mar 2026); StatCounter Global Stats (mobile OS and Android version share, Jun–Sep 2026); Google Android developer verification documentation and Google Security Blog; Android 17 release information.
This section outlines the methodology used for the test conducted in August 2026. The test environment and procedures were designed to ensure objectivity and reproducibility.
| Vendor | Software | Version |
|---|---|---|
| Dr.Web | Dr.Web Mobile Security Suite | 12.9.11(2) |
| ESET | ESET Endpoint Security for Android | v 6.4.10.0-0 |
| Kaspersky | Kaspersky Endpoint Security for Mobile | 10.58.1.38 |
| Total Defense | Total Defense Mobile Security | 16.4.3 |
| Vendor | Total | Missed | Detected | Detection Rate | False Positives | Final Score |
|---|---|---|---|---|---|---|
| ESET | 1368 | 0 | 1368 | 100.00% | 0 | 100.00 |
| Kaspersky | 1368 | 0 | 1368 | 100.00% | 0 | 100.00 |
| Total Defense | 1368 | 5 | 1363 | 99.63% | 0 | 99.63 |
| Dr.Web | 1368 | 19 | 1349 | 98.61% | 0 | 98.61 |
For each security solution, a Final Score is calculated once the full test is performed:
Final Score = (Detection %) × 100 − 0.2 × FP
| Final Score | Monthly Award |
|---|---|
| 98.00 – 100.00 | ★★★★★ 5-star rating |
| 95.00 – 97.99 | ★★★★ 4-star rating |
| 90.00 – 94.99 | ★★★ 3-star rating |
All 4 tested enterprise products achieved 5-star ratings in the August 2026 Android Malware Detection Test from Testing Ground Labs. ESET and Kaspersky achieved a perfect score of 100.00 with zero false positives across 1,368 malware samples.
Gold highlight = Perfect Score (100.00) with zero false positives
This test was made in accordance with the requirements of the AMTSO Testing Protocol Standard v.1.3 (https://www.amtso.org/standards/).
AMTSO's compliance review for this test is in progress. This report will be updated once the review has been completed.
Unless otherwise stated, Testing Ground Labs (hereinafter referred to as "TG Labs"), owns the copyright of this report. Without prior written consent of TG Labs, no other organization or individual shall have the right to alter the contents of this report and use it for commercial purposes by any means (including but not limited to transmission, dissemination, reproduction, excerpt, etc.).
Unless otherwise stated, TG Labs shall be the rightful owner of the trademarks and service marks used in the report. Any action of infringing upon the legal rights of TG Labs is prohibited. TG Labs shall have the right to pursue the legal liability of the infringer in accordance with the law.
Before using this report issued by Testing Ground Labs (hereinafter "TG Labs"), please read and understand the following terms and conditions (the "Disclaimer") carefully, including provisions that limit or exclude TG Labs' liability and that restrict the rights of users. Use of this report constitutes acceptance of, and agreement to, all terms and conditions set forth herein.
TG Labs reserves the right to interpret, amend, and update this Disclaimer at any time.