Kaspersky detected 162,275 new mobile banking Trojan installation packages in the first quarter of 2026, according to findings the company published September 9, 2026 — more than double the number it recorded across all of 2024, and roughly two-thirds of its full-year 2025 total, in a single quarter.
Why it matters: The data suggests attackers are shifting focus specifically toward the money on people’s phones rather than mobile threats generally. Banking Trojans made up 52.96% of all malicious mobile applications Kaspersky detected in Q1 2026, up from roughly 31% across all of 2025 — meaning the mix of mobile threats is tilting harder toward financially motivated attacks, not just growing in overall volume.
The numbers, in context
| Metric | Q1 2026 | Comparison |
|---|---|---|
| New mobile banking Trojan installation packages | 162,275 | More than 2x the full-year 2024 total; ~two-thirds of the full-year 2025 total, in one quarter |
| Banking Trojans’ share of malicious mobile apps | 52.96% | Up from ~31% across all of 2025 |
| Total malicious mobile installation packages detected | 306,070 | — |
| Mobile ransomware Trojan packages detected | 439 | — |
| Mobile attacks blocked (malware, adware, unwanted software) | 2.67 million+ | 2025 full year: 14 million+ blocked globally (~1.17 million/month average) |
These figures come from Kaspersky’s own telemetry (Kaspersky Security Network) and reflect what its products detected and blocked .
The scale of the shift
Kaspersky says the increase reflects growing reliance on mobile devices for shopping, entertainment, communication, and work — which has made phones a more attractive target than they were even a couple of years ago, as more sensitive activity moved off desktop computers and onto handsets.
The trend didn’t appear out of nowhere in 2026. Over the course of 2025, Kaspersky says its products blocked more than 14 million mobile attacks globally, averaging roughly 1.17 million attacks a month. The Q1 2026 banking Trojan numbers build directly on that existing trajectory rather than representing an isolated spike.
How attackers are getting in
Choon Hong Chee, Head of Consumer Channel for APAC at Kaspersky, said cybercriminals are increasingly distributing malicious mobile applications through unofficial app stores, phishing links, fake giveaways, modified versions of legitimate apps, malicious advertising, and scam schemes built to trick users into handing over sensitive information directly.
Kaspersky also says attackers are increasingly abusing legitimate online services and trusted tools specifically to evade detection, with many attacks now unfolding in stages — starting with a file, link, or app that looks harmless, then escalating to malicious activity only after that initial step gains trust or access.
Preinstalled threats: Triada and Keenadu
Among the most frequently encountered mobile threats in Q1 2026, Kaspersky identified preinstalled backdoors — malicious code embedded in device firmware during manufacturing, rather than installed later by the user. Two specific examples named in the findings, Triada and Keenadu, ranked among the most common mobile threats the company encountered.
That distinction matters for how users can realistically protect themselves: a backdoor built into a device before it ever reaches a store shelf isn’t something normal safe-browsing habits or app-store discipline can prevent.
The human cost: messaging-app fraud
A separate Kaspersky consumer study, called The Great Messaging Heist, looked specifically at fraud conducted through messaging apps. It found that a single successful scam message costs the average victim US$733, and that more than half of successful scams (52%) run their full course — from first contact to the point money or personal data changes hands — in under 30 minutes.
Two-thirds of victims (66%) in that study said they believed AI had been used against them in the scam, most commonly through AI-written messages (42%), followed by generated or cloned voices (31%) and deepfake images or video (25%). It’s worth being precise about what that statistic actually shows: it reflects victims’ own belief about whether AI was involved, not a forensically confirmed finding in each case — a meaningful distinction, even if the broader pattern of AI-assisted scams is well documented elsewhere.
What Kaspersky recommends
Kaspersky’s guidance for reducing mobile risk includes installing apps only from trusted marketplaces, avoiding suspicious links or promotional offers, keeping operating systems and apps updated, independently verifying any request for personal information received through messaging platforms, and using a dedicated mobile security tool capable of detecting malicious activity in real time.
Zoom out
The bigger pattern here isn’t just that mobile attacks are growing — it’s that they’re consolidating around financial fraud specifically, at a moment when phones have become the primary device for banking, messaging, and identity verification for most people. As Kaspersky and other security researchers describe it, mobile protection is shifting from an optional add-on to something closer to a basic expectation, particularly across mobile-first markets in Southeast Asia and beyond.
