Kaspersky solutions blocked 1.99 million attacks involving Android malware, adware and potentially unwanted programs during the second quarter of 2026, compared with 2.68 million attacks recorded in the first quarter.
Although the overall number of attacks declined, researchers emphasize that banking-trojan operators have not reduced activity. Instead, they have shifted to new distribution methods that rely on droppers—applications that appear benign, pass initial store screening, and later retrieve the actual malicious payload after installation.
In the reporting period, Kaspersky detected 304,000 malicious Android packages. This total included 93,600 banking-trojan samples and 570 ransomware samples. Banking trojans remained the dominant category, accounting for 30.77 percent of all detections.
One documented case involved a PDF-reader application hosted on Google Play. After installation the app displayed a counterfeit update notification that silently deployed the Anatsa banking trojan onto the device.
Another dropper, distributed under the name Cleanova, transmitted details about the installation source to a command server. The server returned the banking-trojan payload only when the environment matched attacker-defined criteria, allowing the malware to remain dormant inside sandboxes or researcher systems.
The proportion of users attacked by Trojan-Dropper.AndroidOS.Banker.dd increased from 0.01 percent in the first quarter to 2.16 percent in the second quarter. At the same time, the Mamont and Creduz families continued to grow, with developers releasing new builds and testing fresh delivery and evasion techniques.
