Kaspersky detected 1,62,275 new mobile banking Trojan installation packages in the first quarter of 2026, more than twice the number recorded across the whole of 2024, according to data from the Kaspersky Security Network.
Banking Trojans accounted for 52.96% of all malicious mobile applications detected during the quarter, up from about 31% for the full year in 2025. The Q1 figure also represented roughly two-thirds of the banking Trojan packages detected during all of 2025.
Kaspersky said its systems blocked more than 2.67 million attacks involving malware, adware and unwanted mobile software during the quarter. It detected 306,070 malicious mobile installation packages, including 439 packages associated with mobile ransomware Trojans.
Preinstalled backdoors embedded in device firmware during manufacturing, including Triada and Keenadu, were also among the mobile threats most frequently encountered during the quarter.
“Cybercriminals are increasingly leveraging sophisticated techniques to distribute malicious mobile applications through unofficial app stores, phishing links, fake giveaways, modified legitimate applications, malicious advertising campaigns, and mobile scam schemes designed to trick users into revealing sensitive information,” said Choon Hong Chee, Head of Consumer Channel for APAC at Kaspersky.
The findings follow a rise in mobile attacks recorded during 2025, when Kaspersky said its solutions blocked more than 14 million mobile attacks globally.
The company said attackers are also increasingly using legitimate online services and trusted tools to evade detection, with some attacks involving multiple stages that begin with apparently harmless files, links or applications before progressing to malicious activity.