Normal view

Canada Needs Nationalized, Public AI

11 March 2026 at 12:04

Canada has a choice to make about its artificial intelligence future. The Carney administration is investing $2-billion over five years in its Sovereign AI Compute Strategy. Will any value generated by “sovereign AI” be captured in Canada, making a difference in the lives of Canadians, or is this just a passthrough to investment in American Big Tech?

Forcing the question is OpenAI, the company behind ChatGPT, which has been pushing an “OpenAI for Countries” initiative. It is not the only one eyeing its share of the $2-billion, but it appears to be the most aggressive. OpenAI’s top lobbyist in the region has met with Ottawa officials, including Artificial Intelligence Minister Evan Solomon.

All the while, OpenAI was less than open. The company had flagged the Tumbler Ridge, B.C., shooter’s ChatGPT interactions, which included gun-violence chats. Employees wanted to alert law enforcement but were rebuffed. Maybe there is a discussion to be had about users’ privacy. But even after the shooting, the OpenAI representative who met with the B.C. government said nothing.

When tech billionaires and corporations steer AI development, the resultant AI reflects their interests rather than those of the general public or ordinary consumers. Only after the meeting with the B.C. government did OpenAI alert law enforcement. Had it not been for the Wall Street Journal’s reporting, the public would not have known about this at all.

Moreover, OpenAI for Countries is explicitly described by the company as an initiative “in co-ordination with the U.S. government.” And it’s not just OpenAI: all the AI giants are for-profit American companies, operating in their private interests, and subject to United States law and increasingly bowing to U.S. President Donald Trump. Moving data centres into Canada under a proposal like OpenAI’s doesn’t change that. The current geopolitical reality means Canada should not be dependent on U.S. tech firms for essential services such as cloud computing and AI.

While there are Canadian AI companies, they remain for-profit enterprises, their interests not necessarily aligned with our collective good. The only real alternative is to be bold and invest in a wholly Canadian public AI: an AI model built and funded by Canada for Canadians, as public infrastructure. This would give Canadians access to the myriad of benefits from AI without having to depend on the U.S. or other countries. It would mean Canadian universities and public agencies building and operating AI models optimized not for global scale and corporate profit, but for practical use by Canadians.

Imagine AI embedded into health care, triaging radiology scans, flagging early cancer risks and assisting doctors with paperwork. Imagine an AI tutor trained on provincial curriculums, giving personalized coaching. Imagine systems that analyze job vacancies and sectoral and wage trends, then automatically match job seekers to government programs. Imagine using AI to optimize transit schedules, energy grids and zoning analysis. Imagine court processes, corporate decisions and customer service all sped up by AI.

We are already on our way to having AI become an inextricable part of society. To ensure stability and prosperity for this country, Canadian users and developers must be able to turn to AI models built, controlled, and operated publicly in Canada instead of building on corporate platforms, American or otherwise.

Switzerland has shown this to be possible. With funding from the federal government, a consortium of academic institutions—ETH Zurich, EPFL, and the Swiss National Supercomputing Centre—released the world’s most powerful and fully realized public AI model, Apertus, last September. Apertus leveraged renewable hydropower and existing Swiss scientific computing infrastructure. It also used no illegally pirated copyrighted material or poorly paid labour extracted from the Global South during training. The model’s performance stands at roughly a year or two behind the major corporate offerings, but that is more than adequate for the vast majority of applications. And it’s free for anyone to use and build on.

The significance of Apertus is more than technical. It demonstrates an alternative ownership structure for AI technology, one that allocates both decision-making authority and value to national public institutions rather than foreign corporations. This vision represents precisely the paradigm shift Canada should embrace: AI as public infrastructure, like systems for transportation, water, or electricity, rather than private commodity.

Apertus also demonstrates a far more sustainable economic framework for AI. Switzerland spent a tiny fraction of the billions of dollars that corporate AI labs invest annually, demonstrating that the frequent training runs with astronomical price tags pursued by tech companies are not actually necessary for practical AI development. They focused on making something broadly useful rather than bleeding edge—trying dubiously to create “superintelligence,” as with Silicon Valley—so they created a smaller model at much lower cost. Apertus’s training was at a scale (70 billion parameters) perhaps two orders of magnitude lower than the largest Big Tech offerings.

An ecosystem is now being developed on top of Apertus, using the model as a public good to power chatbots for free consumer use and to provide a development platform for companies prioritizing responsible AI use, and rigorous compliance with laws like the EU AI Act. Instead of routing queries from those users to Big Tech infrastructure, Apertus is deployed to data centres across national AI and computing initiatives of Switzerland, Australia, Germany, and Singapore and other partners.

The case for public AI rests on both democratic principles and practical benefits. Public AI systems can incorporate mechanisms for genuine public input and democratic oversight on critical ethical questions: how to handle copyrighted works in training data, how to mitigate bias, how to distribute access when demand outstrips capacity, and how to license use for sensitive applications like policing or medicine. Or how to handle a situation such as that of the Tumbler Ridge shooter. These decisions will profoundly shape society as AI becomes more pervasive, yet corporate AI makes them in secret.

By contrast, public AI developed by transparent, accountable agencies would allow democratic processes and political oversight to govern how these powerful systems function.

Canada already has many of the building blocks for public AI. The country has world-class AI research institutions, including the Vector Institute, Mila, and CIFAR, which pioneered much of the deep learning revolution. Canada’s $2-billion Sovereign AI Compute Strategy provides substantial funding.

What’s needed now is a reorientation away from viewing this as an opportunity to attract private capital, and toward a fully open public AI model.

This essay was written with Nathan E. Sanders, and originally appeared in The Globe and Mail.

Hacked App Part of US/Israeli Propaganda Campaign Against Iran

5 March 2026 at 12:28

Wired has the story:

Shortly after the first set of explosions, Iranians received bursts of notifications on their phones. They came not from the government advising caution, but from an apparently hacked prayer-timing app called BadeSaba Calendar that has been downloaded more than 5 million times from the Google Play Store.

The messages arrived in quick succession over a period of 30 minutes, starting with the phrase ‘Help has arrived’ at 9:52 am Tehran time, shortly after the first set of explosions. No party has claimed responsibility for the hacks.

It happened so fast that this is most likely a government operation. I can easily envision both the US and Israel having hacked the app previously, and then deciding that this is a good use of that access.

A Joint Vision for Simplified SASE Management at Scale

Palo Alto Networks, ServiceNow, and Bell Canada have come together in a strategic collaboration to build an innovative ServiceNow application that creates an automated bridge between world-class security operations and industry-leading service management.

Large enterprises need robust security at cloud speed, but operational complexity keeps getting in the way. ​​Here’s what that looks like in practice:

  • Operations teams juggle multiple dashboards. When an issue surfaces, they are bouncing between the Prisma® SASE (secure access service edge) console to identify the incident, ServiceNow to log the case, and a customer support portal to escalate the issue. Every handoff inflates MTTR (mean time to resolution) and introduces room for error.
  • Customers are stuck in a deployment purgatory. Manual infrastructure configuration, connector setup, and mobile user onboarding can stretch on for weeks or months. Every day spent wrestling with configuration files is a day that value isn’t delivered.
  • Multi-tenant management doesn’t scale. If operational overhead grows linearly with each new tenant, the business model ultimately caps itself.

Bell Canada, through its innovative and security-first approach in the Canadian market, is a lighthouse partner that helped pioneer this innovation through its deep engagement with ServiceNow and a strategic partnership with Palo Alto Networks. With a strong focus on delivering exceptional customer value, Bell helped drive the vision for a simplified, scalable approach to SASE management.

Driven by their commitment to service excellence and customer outcomes, Bell worked closely with Palo Alto Networks and ServiceNow on this solution, accelerating customer time to value and simplifying operational complexity. Bell was among the first to champion this vision, acting as a market thought leader and helping shape a new standard for integrated SASE and service management outcomes in Canada.

Large Enterprises and Managed Service Providers can accelerate time to value by automating the entire lifecycle of Prisma SASE, from deployment to ongoing incident response through a newly launched Prisma SASE app on the ServiceNow store. The Prisma SASE app can accelerate MSP service delivery and management, significantly shrinking time to value and thereby positively impacting both top-line revenue and bottom-line EBITDA.

The Prisma SASE Platform Is Accelerating Value through Unified Automation and Platformization

Time to value (TTV) is one of the most critical metrics for IT teams helping customers move forward. With the Prisma SASE app, customers can go from implementation to go-live in just hours. There’s no need to build custom API integrations or take on technical debt for Day 0 to Day N operations. The app automates infrastructure setup, including ZTNA connectors and mobile user workflows, so providers can get their SASE offerings to market faster.

Comparing ServiceNow with and without Prisma SASE App.
Optimizing Service Delivery through Unified Incident Lifecycle Management.

The joint solution eliminates swivel chair operations. Security and network administrators no longer need to toggle between the Prisma SASE console, ServiceNow and support portals. Incident ingestion and management now happen in one place. Incidents stay in sync, manual overhead drops, and mean time to resolution improves. For MSPs, there’s the added benefit: they can create Palo Alto Networks CSP (Customer Support Portal) tickets directly from the ServiceNow SASE app, making incident correlation and troubleshooting straightforward.

Drive Scalable Growth by Automating Cross-Instance Support with Service Exchange

ServiceNow’s Service Bridge is a major unlock for Managed Service Providers scaling their SASE offerings. It automates cross-instance support so critical security incidents and status updates flow between the MSP’s ServiceNow instance and the customer’s ServiceNow instance without manual sync work. This creates operational transparency and a better service experience for customers while MSPs can deliver faster without adding headcount or complexity.

Key Takeaways:

  • Rapid Time to Value: Shift from months of manual configuration to hours of automated deployment by leveraging out-of-the-box integrations that eliminate custom R&D and technical debt.
  • Unified Operational Excellence: Eliminate "swivel chair" management by unifying incident ingestion, ticket syncing and support portal escalation into a single ServiceNow interface, significantly reducing MTTR.
  • SASE at Scale: The Prisma SASE app provides a unified architecture that scales across tenants automatically, ensuring security keeps pace with business growth.

Take the Next Step

As you adopt SASE, take out the complexity of implementation with the Prisma SASE app.

  • Download the App: Visit the ServiceNow Store today and download the Prisma SASE app to start automating your deployment.
  • Meet Us at MWC: Are you heading to Barcelona for Mobile World Congress (MWC)? Come see these integrations in action. Stop by the Palo Alto Networks booth (Hall 4, Stand D55) for a live demo and to chat with our experts about simplifying your SASE implementation.
  • Contact our sales team for any additional questions.

The post A Joint Vision for Simplified SASE Management at Scale appeared first on Palo Alto Networks Blog.

Mobile malware evolution in 2025

4 March 2026 at 11:00

Starting from the third quarter of 2025, we have updated our statistical methodology based on the Kaspersky Security Network. These changes affect all sections of the report except for the installation package statistics, which remain unchanged.

To illustrate trends between reporting periods, we have recalculated the previous year’s data; consequently, these figures may differ significantly from previously published numbers. All subsequent reports will be generated using this new methodology, ensuring accurate data comparisons with the findings presented in this article.

Kaspersky Security Network (KSN) is a global network for analyzing anonymized threat intelligence, voluntarily shared by Kaspersky users. The statistics in this report are based on KSN data unless explicitly stated otherwise.

The year in figures

According to Kaspersky Security Network, in 2025:

  • Over 14 million attacks involving malware, adware or unwanted mobile software were blocked.
  • Adware remained the most prevalent mobile threat, accounting for 62% of all detections.
  • Over 815 thousand malicious installation packages were detected, including 255 thousand mobile banking Trojans.

The year’s highlights

In 2025, cybercriminals launched an average of approximately 1.17 million attacks per month against mobile devices using malicious, advertising, or unwanted software. In total, Kaspersky solutions blocked 14,059,465 attacks throughout the year.

Attacks on Kaspersky mobile users in 2025 (download)

Beyond the malware mentioned in previous quarterly reports, 2025 saw the discovery of several other notable Trojans. Among these, in Q4 we uncovered the Keenadu preinstalled backdoor. This malware is integrated into device firmware during the manufacturing stage. The malicious code is injected into libandroid_runtime.so – a core library for the Android Java runtime environment – allowing a copy of the backdoor to enter the address space of every app running on the device. Depending on the specific app, the malware can then perform actions such as inflating ad views, displaying banners on behalf of other apps, or hijacking search queries. The functionality of Keenadu is virtually unlimited, as its malicious modules are downloaded dynamically and can be updated remotely.

Cybersecurity researchers also identified the Kimwolf IoT botnet, which specifically targets Android TV boxes. Infected devices are capable of launching DDoS attacks, operating as reverse proxies, and executing malicious commands via a reverse shell. Subsequent analysis revealed that Kimwolf’s reverse proxy functionality was being leveraged by proxy providers to use compromised home devices as residential proxies.

Another notable discovery in 2025 was the LunaSpy Trojan.

LunaSpy Trojan, distributed under the guise of an antivirus app

LunaSpy Trojan, distributed under the guise of an antivirus app

Disguised as antivirus software, this spyware exfiltrates browser passwords, messaging app credentials, SMS messages, and call logs. Furthermore, it is capable of recording audio via the device’s microphone and capturing video through the camera. This threat primarily targeted users in Russia.

Mobile threat statistics

815,735 new unique installation packages were observed in 2025, showing a decrease compared to the previous year. While the decline in 2024 was less pronounced, this past year saw the figure drop by nearly one-third.

Detected Android-specific malware and unwanted software installation packages in 2022–2025 (download)

The overall decrease in detected packages is primarily due to a reduction in apps categorized as not-a-virus. Conversely, the number of Trojans has increased significantly, a trend clearly reflected in the distribution data below.

Detected packages by type

Distribution* of detected mobile software by type, 2024–2025 (download)

* The data for the previous year may differ from previously published data due to some verdicts being retrospectively revised.

A significant increase in Trojan-Banker and Trojan-Spy apps was accompanied by a decline in AdWare and RiskTool files. The most prevalent banking Trojans were Mamont (accounting for 49.8% of apps) and Creduz (22.5%). Leading the persistent adware category were MobiDash (39%), Adlo (27%), and HiddenAd (20%).

Share* of users attacked by each type of malware or unwanted software out of all users of Kaspersky mobile solutions attacked in 2024–2025 (download)

* The total may exceed 100% if the same users encountered multiple attack types.

Trojan-Banker malware saw a significant surge in 2025, not only in terms of unique file counts but also in the total number of attacks. Nevertheless, this category ranked fourth overall, trailing far behind the Trojan file category, which was dominated by various modifications of Triada and Fakemoney.

TOP 20 types of mobile malware

Note that the malware rankings below exclude riskware and potentially unwanted apps, such as RiskTool and adware.

Verdict % 2024* % 2025* Difference in p.p. Change in ranking
Trojan.AndroidOS.Triada.fe 0.04 9.84 +9.80
Trojan.AndroidOS.Triada.gn 2.94 8.14 +5.21 +6
Trojan.AndroidOS.Fakemoney.v 7.46 7.97 +0.51 +1
DangerousObject.Multi.Generic 7.73 5.83 –1.91 –2
Trojan.AndroidOS.Triada.ii 0.00 5.25 +5.25
Trojan-Banker.AndroidOS.Mamont.da 0.10 4.12 +4.02
Trojan.AndroidOS.Triada.ga 10.56 3.75 –6.81 –6
Trojan-Banker.AndroidOS.Mamont.db 0.01 3.53 +3.51
Backdoor.AndroidOS.Triada.z 0.00 2.79 +2.79
Trojan-Banker.AndroidOS.Coper.c 0.81 2.54 +1.72 +35
Trojan-Clicker.AndroidOS.Agent.bh 0.34 2.48 +2.14 +74
Trojan-Dropper.Linux.Agent.gen 1.82 2.37 +0.55 +4
Trojan.AndroidOS.Boogr.gsh 5.41 2.06 –3.35 –8
DangerousObject.AndroidOS.GenericML 2.42 1.97 –0.45 –3
Trojan.AndroidOS.Triada.gs 3.69 1.93 –1.76 –9
Trojan-Downloader.AndroidOS.Agent.no 0.00 1.87 +1.87
Trojan.AndroidOS.Triada.hf 0.00 1.75 +1.75
Trojan-Banker.AndroidOS.Mamont.bc 1.13 1.65 +0.51 +8
Trojan.AndroidOS.Generic. 2.13 1.47 –0.66 –6
Trojan.AndroidOS.Triada.hy 0.00 1.44 +1.44

* Unique users who encountered this malware as a percentage of all attacked users of Kaspersky mobile solutions.

The list is largely dominated by the Triada family, which is distributed via malicious modifications of popular messaging apps. Another infection vector involves tricking victims into installing an official messaging app within a “customized virtual environment” that supposedly offers enhanced configuration options. Fakemoney scam applications, which promise fraudulent investment opportunities or fake payouts, continue to target users frequently, ranking third in our statistics. Meanwhile, the Mamont banking Trojan variants occupy the 6th, 8th, and 18th positions by number of attacks. The Triada backdoor preinstalled in the firmware of certain devices reached the 9th spot.

Region-specific malware

This section describes malware families whose attack campaigns are concentrated within specific countries.

Verdict Country* %**
Trojan-Banker.AndroidOS.Coper.a Türkiye 95.74
Trojan-Dropper.AndroidOS.Hqwar.bj Türkiye 94.96
Trojan.AndroidOS.Thamera.bb India 94.71
Trojan-Proxy.AndroidOS.Agent.q Germany 93.70
Trojan-Banker.AndroidOS.Coper.c Türkiye 93.42
Trojan-Banker.AndroidOS.Rewardsteal.lv India 92.44
Trojan-Banker.AndroidOS.Rewardsteal.jp India 92.31
Trojan-Banker.AndroidOS.Rewardsteal.ib India 91.91
Trojan-Dropper.AndroidOS.Rewardsteal.h India 91.45
Trojan-Banker.AndroidOS.Rewardsteal.nk India 90.98
Trojan-Dropper.AndroidOS.Agent.sm Türkiye 90.34
Trojan-Dropper.AndroidOS.Rewardsteal.ac India 89.38
Trojan-Banker.AndroidOS.Rewardsteal.oa India 89.18
Trojan-Banker.AndroidOS.Rewardsteal.ma India 88.58
Trojan-Spy.AndroidOS.SmForw.ko India 88.48
Trojan-Dropper.AndroidOS.Pylcasa.c Brazil 88.25
Trojan-Dropper.AndroidOS.Hqwar.bf Türkiye 88.15
Trojan-Banker.AndroidOS.Agent.pp India 87.85

* Country where the malware was most active.
** Unique users who encountered the malware in the indicated country as a percentage of all users of Kaspersky mobile solutions who were attacked by the same malware.

Türkiye saw the highest concentration of attacks from Coper banking Trojans and their associated Hqwar droppers. In India, Rewardsteal Trojans continued to proliferate, exfiltrating victims’ payment data under the guise of monetary giveaways. Additionally, India saw a resurgence of the Thamera Trojan, which we previously observed frequently attacking users in 2023. This malware hijacks the victim’s device to illicitly register social media accounts.

The Trojan-Proxy.AndroidOS.Agent.q campaign, concentrated in Germany, utilized a compromised third-party application designed for tracking discounts at a major German retail chain. Attackers monetized these infections through unauthorized use of the victims’ devices as residential proxies.

In Brazil, 2025 saw a concentration of Pylcasa Trojan attacks. This malware is primarily used to redirect users to phishing pages or illicit online casino sites.

Mobile banking Trojans

The number of new banking Trojan installation packages surged to 255,090, representing a several-fold increase over previous years.

Mobile banking Trojan installation packages detected by Kaspersky in 2022–2025 (download)

Notably, the total number of attacks involving bankers grew by 1.5 times, maintaining the same growth rate seen in the previous year. Given the sharp spike in the number of unique malicious packages, we can conclude that these attacks yield significant profit for cybercriminals. This is further evidenced by the fact that threat actors continue to diversify their delivery channels and accelerate the production of new variants in an effort to evade detection by security solutions.

TOP 10 mobile bankers

Verdict % 2024* % 2025* Difference in p.p. Change in ranking
Trojan-Banker.AndroidOS.Mamont.da 0.86 15.65 +14.79 +28
Trojan-Banker.AndroidOS.Mamont.db 0.12 13.41 +13.29
Trojan-Banker.AndroidOS.Coper.c 7.19 9.65 +2.46 +2
Trojan-Banker.AndroidOS.Mamont.bc 10.03 6.26 –3.77 –3
Trojan-Banker.AndroidOS.Mamont.ev 0.00 4.10 +4.10
Trojan-Banker.AndroidOS.Coper.a 9.04 4.00 –5.04 –4
Trojan-Banker.AndroidOS.Mamont.ek 0.00 3.73 +3.73
Trojan-Banker.AndroidOS.Mamont.cb 0.64 3.04 +2.40 +26
Trojan-Banker.AndroidOS.Faketoken.pac 2.17 2.95 +0.77 +5
Trojan-Banker.AndroidOS.Mamont.hi 0.00 2.75 +2.75

* Unique users who encountered this malware as a percentage of all users of Kaspersky mobile solutions who encountered banking threats.

In 2025, we observed a massive surge in activity from Mamont banking Trojans. They accounted for approximately half of all new apps in their category and also were utilized in half of all banking Trojan attacks.

Conclusion

The year 2025 saw a continuing trend toward a decline in total unique unwanted software installation packages. However, we noted a significant year-over-year increase in specific threats – most notably mobile banking Trojans and spyware – even though adware remained the most frequently detected threat overall.

Among the mobile threats detected, we have seen an increased prevalence of preinstalled backdoors, such as Triada and Keenadu. Consistent with last year’s findings, certain mobile malware families continue to proliferate via official app stores. Finally, we have observed a growing interest among threat actors in leveraging compromised devices as proxies.

Mobile malware evolution in 2025

4 March 2026 at 11:00

Starting from the third quarter of 2025, we have updated our statistical methodology based on the Kaspersky Security Network. These changes affect all sections of the report except for the installation package statistics, which remain unchanged.

To illustrate trends between reporting periods, we have recalculated the previous year’s data; consequently, these figures may differ significantly from previously published numbers. All subsequent reports will be generated using this new methodology, ensuring accurate data comparisons with the findings presented in this article.

Kaspersky Security Network (KSN) is a global network for analyzing anonymized threat intelligence, voluntarily shared by Kaspersky users. The statistics in this report are based on KSN data unless explicitly stated otherwise.

The year in figures

According to Kaspersky Security Network, in 2025:

  • Over 14 million attacks involving malware, adware or unwanted mobile software were blocked.
  • Adware remained the most prevalent mobile threat, accounting for 62% of all detections.
  • Over 815 thousand malicious installation packages were detected, including 255 thousand mobile banking Trojans.

The year’s highlights

In 2025, cybercriminals launched an average of approximately 1.17 million attacks per month against mobile devices using malicious, advertising, or unwanted software. In total, Kaspersky solutions blocked 14,059,465 attacks throughout the year.

Attacks on Kaspersky mobile users in 2025 (download)

Beyond the malware mentioned in previous quarterly reports, 2025 saw the discovery of several other notable Trojans. Among these, in Q4 we uncovered the Keenadu preinstalled backdoor. This malware is integrated into device firmware during the manufacturing stage. The malicious code is injected into libandroid_runtime.so – a core library for the Android Java runtime environment – allowing a copy of the backdoor to enter the address space of every app running on the device. Depending on the specific app, the malware can then perform actions such as inflating ad views, displaying banners on behalf of other apps, or hijacking search queries. The functionality of Keenadu is virtually unlimited, as its malicious modules are downloaded dynamically and can be updated remotely.

Cybersecurity researchers also identified the Kimwolf IoT botnet, which specifically targets Android TV boxes. Infected devices are capable of launching DDoS attacks, operating as reverse proxies, and executing malicious commands via a reverse shell. Subsequent analysis revealed that Kimwolf’s reverse proxy functionality was being leveraged by proxy providers to use compromised home devices as residential proxies.

Another notable discovery in 2025 was the LunaSpy Trojan.

LunaSpy Trojan, distributed under the guise of an antivirus app

LunaSpy Trojan, distributed under the guise of an antivirus app

Disguised as antivirus software, this spyware exfiltrates browser passwords, messaging app credentials, SMS messages, and call logs. Furthermore, it is capable of recording audio via the device’s microphone and capturing video through the camera. This threat primarily targeted users in Russia.

Mobile threat statistics

815,735 new unique installation packages were observed in 2025, showing a decrease compared to the previous year. While the decline in 2024 was less pronounced, this past year saw the figure drop by nearly one-third.

Detected Android-specific malware and unwanted software installation packages in 2022–2025 (download)

The overall decrease in detected packages is primarily due to a reduction in apps categorized as not-a-virus. Conversely, the number of Trojans has increased significantly, a trend clearly reflected in the distribution data below.

Detected packages by type

Distribution* of detected mobile software by type, 2024–2025 (download)

* The data for the previous year may differ from previously published data due to some verdicts being retrospectively revised.

A significant increase in Trojan-Banker and Trojan-Spy apps was accompanied by a decline in AdWare and RiskTool files. The most prevalent banking Trojans were Mamont (accounting for 49.8% of apps) and Creduz (22.5%). Leading the persistent adware category were MobiDash (39%), Adlo (27%), and HiddenAd (20%).

Share* of users attacked by each type of malware or unwanted software out of all users of Kaspersky mobile solutions attacked in 2024–2025 (download)

* The total may exceed 100% if the same users encountered multiple attack types.

Trojan-Banker malware saw a significant surge in 2025, not only in terms of unique file counts but also in the total number of attacks. Nevertheless, this category ranked fourth overall, trailing far behind the Trojan file category, which was dominated by various modifications of Triada and Fakemoney.

TOP 20 types of mobile malware

Note that the malware rankings below exclude riskware and potentially unwanted apps, such as RiskTool and adware.

Verdict % 2024* % 2025* Difference in p.p. Change in ranking
Trojan.AndroidOS.Triada.fe 0.04 9.84 +9.80
Trojan.AndroidOS.Triada.gn 2.94 8.14 +5.21 +6
Trojan.AndroidOS.Fakemoney.v 7.46 7.97 +0.51 +1
DangerousObject.Multi.Generic 7.73 5.83 –1.91 –2
Trojan.AndroidOS.Triada.ii 0.00 5.25 +5.25
Trojan-Banker.AndroidOS.Mamont.da 0.10 4.12 +4.02
Trojan.AndroidOS.Triada.ga 10.56 3.75 –6.81 –6
Trojan-Banker.AndroidOS.Mamont.db 0.01 3.53 +3.51
Backdoor.AndroidOS.Triada.z 0.00 2.79 +2.79
Trojan-Banker.AndroidOS.Coper.c 0.81 2.54 +1.72 +35
Trojan-Clicker.AndroidOS.Agent.bh 0.34 2.48 +2.14 +74
Trojan-Dropper.Linux.Agent.gen 1.82 2.37 +0.55 +4
Trojan.AndroidOS.Boogr.gsh 5.41 2.06 –3.35 –8
DangerousObject.AndroidOS.GenericML 2.42 1.97 –0.45 –3
Trojan.AndroidOS.Triada.gs 3.69 1.93 –1.76 –9
Trojan-Downloader.AndroidOS.Agent.no 0.00 1.87 +1.87
Trojan.AndroidOS.Triada.hf 0.00 1.75 +1.75
Trojan-Banker.AndroidOS.Mamont.bc 1.13 1.65 +0.51 +8
Trojan.AndroidOS.Generic. 2.13 1.47 –0.66 –6
Trojan.AndroidOS.Triada.hy 0.00 1.44 +1.44

* Unique users who encountered this malware as a percentage of all attacked users of Kaspersky mobile solutions.

The list is largely dominated by the Triada family, which is distributed via malicious modifications of popular messaging apps. Another infection vector involves tricking victims into installing an official messaging app within a “customized virtual environment” that supposedly offers enhanced configuration options. Fakemoney scam applications, which promise fraudulent investment opportunities or fake payouts, continue to target users frequently, ranking third in our statistics. Meanwhile, the Mamont banking Trojan variants occupy the 6th, 8th, and 18th positions by number of attacks. The Triada backdoor preinstalled in the firmware of certain devices reached the 9th spot.

Region-specific malware

This section describes malware families whose attack campaigns are concentrated within specific countries.

Verdict Country* %**
Trojan-Banker.AndroidOS.Coper.a Türkiye 95.74
Trojan-Dropper.AndroidOS.Hqwar.bj Türkiye 94.96
Trojan.AndroidOS.Thamera.bb India 94.71
Trojan-Proxy.AndroidOS.Agent.q Germany 93.70
Trojan-Banker.AndroidOS.Coper.c Türkiye 93.42
Trojan-Banker.AndroidOS.Rewardsteal.lv India 92.44
Trojan-Banker.AndroidOS.Rewardsteal.jp India 92.31
Trojan-Banker.AndroidOS.Rewardsteal.ib India 91.91
Trojan-Dropper.AndroidOS.Rewardsteal.h India 91.45
Trojan-Banker.AndroidOS.Rewardsteal.nk India 90.98
Trojan-Dropper.AndroidOS.Agent.sm Türkiye 90.34
Trojan-Dropper.AndroidOS.Rewardsteal.ac India 89.38
Trojan-Banker.AndroidOS.Rewardsteal.oa India 89.18
Trojan-Banker.AndroidOS.Rewardsteal.ma India 88.58
Trojan-Spy.AndroidOS.SmForw.ko India 88.48
Trojan-Dropper.AndroidOS.Pylcasa.c Brazil 88.25
Trojan-Dropper.AndroidOS.Hqwar.bf Türkiye 88.15
Trojan-Banker.AndroidOS.Agent.pp India 87.85

* Country where the malware was most active.
** Unique users who encountered the malware in the indicated country as a percentage of all users of Kaspersky mobile solutions who were attacked by the same malware.

Türkiye saw the highest concentration of attacks from Coper banking Trojans and their associated Hqwar droppers. In India, Rewardsteal Trojans continued to proliferate, exfiltrating victims’ payment data under the guise of monetary giveaways. Additionally, India saw a resurgence of the Thamera Trojan, which we previously observed frequently attacking users in 2023. This malware hijacks the victim’s device to illicitly register social media accounts.

The Trojan-Proxy.AndroidOS.Agent.q campaign, concentrated in Germany, utilized a compromised third-party application designed for tracking discounts at a major German retail chain. Attackers monetized these infections through unauthorized use of the victims’ devices as residential proxies.

In Brazil, 2025 saw a concentration of Pylcasa Trojan attacks. This malware is primarily used to redirect users to phishing pages or illicit online casino sites.

Mobile banking Trojans

The number of new banking Trojan installation packages surged to 255,090, representing a several-fold increase over previous years.

Mobile banking Trojan installation packages detected by Kaspersky in 2022–2025 (download)

Notably, the total number of attacks involving bankers grew by 1.5 times, maintaining the same growth rate seen in the previous year. Given the sharp spike in the number of unique malicious packages, we can conclude that these attacks yield significant profit for cybercriminals. This is further evidenced by the fact that threat actors continue to diversify their delivery channels and accelerate the production of new variants in an effort to evade detection by security solutions.

TOP 10 mobile bankers

Verdict % 2024* % 2025* Difference in p.p. Change in ranking
Trojan-Banker.AndroidOS.Mamont.da 0.86 15.65 +14.79 +28
Trojan-Banker.AndroidOS.Mamont.db 0.12 13.41 +13.29
Trojan-Banker.AndroidOS.Coper.c 7.19 9.65 +2.46 +2
Trojan-Banker.AndroidOS.Mamont.bc 10.03 6.26 –3.77 –3
Trojan-Banker.AndroidOS.Mamont.ev 0.00 4.10 +4.10
Trojan-Banker.AndroidOS.Coper.a 9.04 4.00 –5.04 –4
Trojan-Banker.AndroidOS.Mamont.ek 0.00 3.73 +3.73
Trojan-Banker.AndroidOS.Mamont.cb 0.64 3.04 +2.40 +26
Trojan-Banker.AndroidOS.Faketoken.pac 2.17 2.95 +0.77 +5
Trojan-Banker.AndroidOS.Mamont.hi 0.00 2.75 +2.75

* Unique users who encountered this malware as a percentage of all users of Kaspersky mobile solutions who encountered banking threats.

In 2025, we observed a massive surge in activity from Mamont banking Trojans. They accounted for approximately half of all new apps in their category and also were utilized in half of all banking Trojan attacks.

Conclusion

The year 2025 saw a continuing trend toward a decline in total unique unwanted software installation packages. However, we noted a significant year-over-year increase in specific threats – most notably mobile banking Trojans and spyware – even though adware remained the most frequently detected threat overall.

Among the mobile threats detected, we have seen an increased prevalence of preinstalled backdoors, such as Triada and Keenadu. Consistent with last year’s findings, certain mobile malware families continue to proliferate via official app stores. Finally, we have observed a growing interest among threat actors in leveraging compromised devices as proxies.

❌