Kaspersky's Q1 2026 Android threat report reveals over 2.67 million mobile attacks were blocked, with banking Trojans surging 50% quarter-over-quarter to 162,275 detected packages. Mamont variants dominated banking Trojans at 73.5% of detections. The pre-installed Triada.ag backdoor climbed to the top of the malware rankings due to its wide device distribution. A new version of the SparkCat crypto stealer was found on both Google Play and the App Store, using a Rust library obfuscated via a custom Dalvik-like VM on Android and Apple's Vision framework for OCR on iOS. Overall attack volume dropped due to fewer adware and RiskTool detections, but unique users targeted remained stable.
Table of contents
The quarter in numbersQuarterly highlightsMobile threat statisticsTOP 20 most frequently detected types of mobile malwareMobile banking TrojansSort: