Statistics on Android malware and the most notable mobile threats of 2025: preinstalled backdoors Keenadu and Triada, spyware Trojans, the Kimwolf IoT botnet, and Mamont banking Trojans.

Securelist is a cybersecurity blog and research platform operated by Kaspersky Lab. It offers insights, analysis, and reports on cybersecurity threats, vulnerabilities, and malware campaigns. Developers can learn about emerging cyber threats, security best practices, and mitigation strategies to protect their applications and systems. Additionally, Securelist provides insights into cybersecurity trends, threat intelligence, and industry developments, offering resources for cybersecurity professionals.

Securelist

Kaspersky's 2025 mobile threat report reveals over 14 million attacks blocked, with adware accounting for 62% of detections. Key findings include a massive surge in banking Trojans (255,090 new packages, several-fold increase), dominated by the Mamont family which accounted for ~50% of banking Trojan attacks. Notable threats include the Keenadu preinstalled backdoor injected into Android firmware, the Kimwolf IoT botnet targeting Android TV boxes for DDoS and proxy abuse, and the LunaSpy spyware disguised as antivirus software. The Triada family dominated the top malware rankings. Region-specific campaigns concentrated in Turkey (Coper banking Trojans), India (Rewardsteal Trojans), and Brazil (Pylcasa). A growing trend of compromised devices being used as residential proxies was also observed.

The mobile threat landscape in 2025