8 minhigh
IT threat evolution in Q2 2026. Mobile statistics
Kaspersky Q2 2026 mobile threat telemetry shows a continued decline in overall mobile attacks to 1.99 million, but banking Trojans remain the dominant threat category at 30.77% of detected applications. Multiple malicious loaders were found on Google Play, including a trojanized PDF reader dropping Anatsa and the Cleanova app using SDK-based installation source telemetry to selectively deliver payloads only to targeted victims. The Creduz banking Trojan family saw a surge in detected packages without corresponding victim telemetry, indicating active development cycles by the threat actors.
Conf:high
Detection / Hunteropenrouter
What Happened
A security company reported that attacks on mobile phones decreased in the second quarter of 2026, but banking malware remained the biggest threat. Criminals uploaded malicious apps to the official Google Play store, disguised as legitimate apps like a PDF reader. One app, called Cleanova, checked where it was installed from and only activated its malicious behavior for specific targets, making it hard for app store reviewers to detect. A banking malware family called Creduz appeared in large numbers but with few real victims, suggesting criminals are still developing and testing it. Another family called Mamont was the most active banking threat, with several new versions appearing. Organizations with Android device fleets should review app installation policies and consider mobile threat defense tools.
Key Takeaways
- Malicious loaders were discovered hosted directly on Google Play, including a trojanized PDF reader app that dropped the Anatsa banking Trojan via a fake update prompt.
- The Cleanova app loader used analytics SDK telemetry to determine the installation source and only delivered its payload for targeted sources, effectively hiding malicious behavior from app store review scanners.
- The Creduz banking Trojan family showed a large increase in detected installation packages but low victim telemetry, suggesting threat actors are iterating on builds before a broader campaign.
- Mamont banking Trojan variants dominated real-world attack metrics, with multiple new variants climbing into the top 10 mobile bankers leaderboard.
- Trojan-Spy.AndroidOS.Btmob.e and Trojan-Spy.AndroidOS.Agent.asa appeared in the top 20 malware detections with no prior quarter presence, indicating new or resurgent spyware campaigns.
Affected Systems
- Android mobile devices
- Google Play Store ecosystem
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Malicious apps uploaded to Google Play, including a trojanized PDF reader and the Cleanova app, masquerading as legitimate utilities
- Defense Evasion: Cleanova loader queries analytics SDKs for installation source; if the source is outside the threat actors' targeting scope, the malicious logic remains dormant to evade app store review
- Execution: Anatsa loader presents a fake update prompt to the user, which serves as a front to download and install the banking Trojan payload
- Credential Access: Banking Trojans (Mamont, Anatsa, Creduz) capture financial credentials and sensitive user data on the device
- Persistence: Banking Trojans maintain presence on the device to intercept ongoing financial transactions and credentials
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
This is a statistical trends report. No detection rules, queries, or signatures are provided.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Mobile EDR or MDM solutions with application behavior monitoring could detect the fake update prompts and conditional payload delivery. Visibility depends on whether the organization deploys mobile threat defense tools on managed Android devices. |
| Network Visibility | Low | The Cleanova loader communicates with a C2 server to receive payloads, but no C2 indicators are published in this report. Network-based detection would require knowledge of the C2 infrastructure. |
| Detection Difficulty | Hard | The SDK-based installation source check in Cleanova means the malware remains dormant when installed from non-targeted sources, making it difficult to detect in test environments or app store review pipelines. The fake update prompt in Anatsa mimics legitimate app behavior. |
Required Log Sources
- Mobile device management (MDM) application install logs
- Mobile threat defense solution alerts
- Google Play managed distribution logs
- DNS resolution logs from mobile devices
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for Android apps installed from Google Play that subsequently request installation of additional packages or updates from non-Play sources, which may indicate a loader staging a banking Trojan. | MDM application install events, mobile device package installation logs, network traffic to non-Play download sources | Execution | Medium — legitimate apps may request updates from their own CDN; correlation with known-benign update behavior is needed. |
| Consider hunting for mobile apps that query analytics or installation tracking SDKs and then initiate network connections to unfamiliar domains shortly after, which may indicate conditional payload delivery based on installation source. | Mobile network traffic logs, application behavior telemetry from mobile threat defense solutions | Defense Evasion | High — many legitimate apps use analytics SDKs and make network calls; this pattern alone is not indicative of compromise. |
| Consider hunting for Android devices with newly installed apps exhibiting overlay window permissions or accessibility service enrollment shortly after installation, which may indicate banking Trojan credential capture activity. | Mobile device permission change logs, accessibility service enrollment events, MDM policy compliance alerts | Credential Access | Medium — some legitimate apps request accessibility permissions; focus on apps installed from outside managed distribution. |
Control Gaps
- App store review processes may not detect malware that conditionally activates based on installation source telemetry
- Static analysis of app packages may miss dynamically loaded payloads staged through fake update prompts
- Network-based detection is limited without published C2 indicators for the banking Trojans discussed
Key Behavioral Indicators
- Android apps requesting installation of additional APKs from non-Google Play sources after presenting a fake update prompt
- Mobile apps querying installation source tracking SDKs before deciding whether to contact a remote server
- Newly installed apps requesting accessibility service permissions or overlay window permissions within a short time window
- Multiple Mamont banking Trojan variants detected on the same device or across devices in the same organization
False Positive Assessment
Medium — The described behaviors (fake update prompts, SDK telemetry queries, overlay permissions) overlap with legitimate app functionality. Detection rules based on these patterns would require additional context such as process ancestry, network destination reputation, or correlation with known malware family indicators to reduce false positives.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider reviewing managed Android device inventories for any installed apps matching the described loader behavior patterns (PDF readers or cleaner apps requesting updates from non-Play sources).
- If your MDM or mobile threat defense solution supports it, consider blocking sideloading of APKs from non-Google Play sources on managed Android devices.
- Consider reviewing Google Play managed distribution lists to ensure no apps named 'Cleanova' or suspicious PDF reader apps are approved for installation.
Infrastructure Hardening
- Evaluate whether your mobile device management policy enforces installation only from managed Google Play accounts rather than consumer Play Store access.
- Consider implementing network-level blocking of known mobile banking Trojan C2 infrastructure if threat intelligence feeds are available, though no specific indicators are published in this report.
- If applicable, evaluate whether your organization's mobile security posture includes runtime application behavior analysis rather than relying solely on static app vetting.
User Protection
- Consider deploying mobile threat defense solutions on managed Android devices that can detect overlay attacks and suspicious accessibility service enrollment.
- Evaluate whether your endpoint protection extends to mobile devices with behavioral detection for fake update prompts leading to APK installation.
- If your organization supports BYOD Android devices, consider requiring installation of a mobile security agent as a condition of access.
Security Awareness
- Consider incorporating guidance into existing awareness programs about verifying app update prompts within the app itself rather than approving prompts that redirect to external download sources.
- Where applicable, remind users that apps on Google Play are not guaranteed safe and that unusual permission requests (accessibility, overlay) from utility apps warrant scrutiny.
- Consider adding mobile-specific phishing guidance to existing training, noting that banking Trojans may impersonate legitimate financial apps via overlay windows.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping4 techniques