Kaspersky Q3 2026 Mobile Threat Statistics: Mamont/Creduz banker droppers, Triada/Vo1d preinstalled malware, AI-assisted Android fraud, DarkSword iOS exploit kit

Key facts

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5629 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Mamont/Creduz/BeatBanker Android Dropper and Banker Verdicts in AV Telemetry

Detects Kaspersky endpoint/mobile verdicts for the Android banker droppers and bankers featured in the Q3 2026 Securelist mobile report: Trojan-Dropper Mamont (.am, .aq), Creduz (.t), BeatBanker (.c), Trojan-Banker Mamont (.hl, .lf, .od) and Agent (.ws, .eq), plus Subscriber.bh (hidden-WebView subscription fraud with SMS interception). Also flags the community-observed APK sha256 312ccddf... from OSINT sibling indicators. Indicates user-executed malicious app install (T1204.002), disguised apps (T1655.001) and SMS interception (T1636.004).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.002, T1655.001, T1636.004
• Data sources: Kaspersky Security Center CEF (index=av, sourcetype=cef), CommonSecurityLog (Kaspersky CEF connector), antivirus logsource
• Severity: high
• Confidence: high

Splunk SPL

index=av sourcetype="cef" earliest=-24h ("Kaspersky" OR "312ccddffce813529d27c0962b140c031e6d7e8aa8eec3f4c6ada40d16d775d0")
```Verdict names from the Securelist Q3 2026 mobile statistics plus one community-tier sha256```
| regex _raw="(?i)(Trojan-Dropper[.]AndroidOS[.](Mamont|Creduz|BeatBanker)[.][a-z]+|Trojan-Banker[.]AndroidOS[.](Mamont[.][a-z]+|Agent[.](ws|eq))|Trojan[.]AndroidOS[.]Subscriber[.]bh|312ccddffce813529d27c0962b140c031e6d7e8aa8eec3f4c6ada40d16d775d0)"
| rex field=_raw "(?<verdict>Trojan(-[A-Za-z]+)?[.]AndroidOS[.][A-Za-z0-9]+[.][a-z0-9]+)"
| eval verdict=coalesce(verdict, "community_sha256_match")
| stats count min(_time) as first_seen max(_time) as last_seen values(src) as src values(dest) as dest values(user) as user by host, verdict
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen host verdict count src dest user

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor has 'Kaspersky' or tostring(AdditionalExtensions) has '312ccddffce813529d27c0962b140c031e6d7e8aa8eec3f4c6ada40d16d775d0'
| extend Raw = strcat(Activity, ' ', Message, ' ', FileName, ' ', tostring(AdditionalExtensions))
| where Raw matches regex @'(?i)(Trojan-Dropper[.]AndroidOS[.](Mamont|Creduz|BeatBanker)[.][a-z]+|Trojan-Banker[.]AndroidOS[.](Mamont[.][a-z]+|Agent[.](ws|eq))|Trojan[.]AndroidOS[.]Subscriber[.]bh|312ccddffce813529d27c0962b140c031e6d7e8aa8eec3f4c6ada40d16d775d0)'
| extend Verdict = coalesce(extract(@'(?i)(Trojan(?:-[A-Za-z]+)?[.]AndroidOS[.][A-Za-z0-9]+[.][a-z0-9]+)', 1, Raw), 'community_sha256_match')
| project TimeGenerated, DeviceVendor, DeviceProduct, Computer, SourceUserName, Verdict, Activity, Message

Sigma

title: Android Banker Dropper and Banker Verdicts (Mamont, Creduz, BeatBanker, Subscriber)
id: b83f7d51-0a96-4e2c-95b4-1c6d3a8e07f9
status: experimental
description: Detects antivirus/mobile-protection verdicts for Mamont, Creduz and BeatBanker droppers, Mamont and Agent banking Trojans and Subscriber.bh named in the Kaspersky Q3 2026 mobile threat statistics report.
references:
  - https://securelist.com/malware-report-q3-2026-mobile-statistics/121844/
author: Threadlinqs Team
date: 2026-11-10
tags:
  - attack.execution
  - attack.t1204.002
  - attack.defense-evasion
  - attack.t1655.001
  - attack.collection
  - attack.t1636.004
logsource:
  product: antivirus
detection:
  selection:
    Signature|contains:
      - 'Trojan-Dropper.AndroidOS.Mamont'
      - 'Trojan-Dropper.AndroidOS.Creduz'
      - 'Trojan-Dropper.AndroidOS.BeatBanker'
      - 'Trojan-Banker.AndroidOS.Mamont'
      - 'Trojan-Banker.AndroidOS.Agent.ws'
      - 'Trojan-Banker.AndroidOS.Agent.eq'
      - 'Trojan.AndroidOS.Subscriber.bh'
  condition: selection
falsepositives:
  - Security teams detonating known Android samples in a lab with AV telemetry forwarded
  - Test detections using EICAR-style Android samples named after these families
level: high

Known false positives:

• Malware analysts or sandboxes forwarding AV telemetry for detonated samples
• Retroactive re-scans that re-report already quarantined detections

Tuning notes: Adjust index/sourcetype to wherever Kaspersky Security Center or your MTD product forwards events; verdict naming differs per vendor, so add vendor aliases (for example Defender Trojan:AndroidOS/Mamont). The sha256 is community-tier (OSINT sibling) and should be treated as corroboration only. Suppress lab hosts by host/user allow-list.

• 🔒 Composer Command Installing Trojanized OphimCMS/KKPhim Theme Package · unlock with TL Creds
• 🔒 Preinstalled Triada/Vo1d Backdoor/Proxy and BTMOB/SpyNote Spyware Alerts · unlock with TL Creds
• 🔒 Rotating C2 Pool: Large POST /upload to First-Seen Host (DarkSword-Style Encrypted Exfiltration) · unlock with TL Creds
• 🔒 Unpatched iOS 18.4-18.7 Device Contacting DarkSword Exploit-Chain Infrastructure · unlock with TL Creds
• 🔒 Vulnerable iOS Client POSTing Encrypted Data to /upload (Keychain and Wallet-Seed Exfiltration) · unlock with TL Creds
• 🔒 DNS Resolution of DarkSword and Fake Google Play Infrastructure Domains · unlock with TL Creds
• 🔒 Trojanized Packagist OphimCMS/KKPhim Theme Package Retrieval (DarkSword iOS Chain Delivery) · unlock with TL Creds
• 🔒 DarkSword Progress Beacon and Encrypted Upload to Known C2 Infrastructure ([indicator], [indicator]) · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 29 indicators of compromise for TL-2026-5629.

Sample indicators (2 of 29)

• Domain: cloudfareintcdn[.]com
• Domain: snapshare[.]chat

Defanged, TLP:CLEAR. Full set of 29 indicators: unlock with TL Creds.

Technical analysis

The report also covers AI-assisted Android malware and the DarkSword iOS exploit kit delivered through 13 infected Packagist packages and the FomoPeek fake App Store app.

Kaspersky's Q3 2026 mobile statistics report (Securelist, Anton Kivva, 2026-11-10, based on Kaspersky Security Network telemetry from consenting users) records 1,668,368 blocked attacks involving mobile malware, adware or unwanted software, down about 16.5% from 1,996,823 in Q2. Detected malicious Android installation packages rose to 378,456, of which 119,688 were mobile banking Trojans. Trojan-Banker was the most prevalent category at 31.63% of detected malicious apps, and standalone banking Trojans plus droppers made up more than half of all detected malicious apps. Trojan-Dropper detections rose sharply because droppers deliver known bankers such as Mamont and Creduz. Creduz has the largest share by type, while Mamont variants were the most active in actual attacks. Adware (HiddenAd, MobiDash) declined but still ranks first by number of attacked users. Among Trojan-Spy attacks the largest growth came from BTMOB and SpyNote RAT.

Top-20 verdicts by unique users were led by the preinstalled backdoor Backdoor.AndroidOS.Triada.ag (13.14%, up from 9.35%), followed by Trojan.AndroidOS.Boogr.gsh (5.21%), DangerousObject.AndroidOS.GenericML (4.61%) and DangerousObject.Multi.Generic (4.01%). The main newcomer was Trojan-Proxy.AndroidOS.Vo1d.b (0.07% to 3.20%), delivered by preinstalled Trojans, which turns devices into VPN exit nodes, consuming users' data and enabling illegal activity in the victim's name; Trojan.AndroidOS.Vo1d.c also entered at 2.16%. New droppers entered the list: Trojan-Dropper.AndroidOS.Mamont.am (2.72%), Mamont.aq (2.03%) and Creduz.t (1.30%), alongside Trojan-Dropper.AndroidOS.BeatBanker.c (1.33%) and Trojan-Spy.AndroidOS.Btmob.c (2.09%, up 22 places). In the top-10 bankers, Trojan-Banker.AndroidOS.Mamont.hl led (10.31%), followed by Agent.ws (7.42%), Agent.eq (5.58%), Mamont.lf (5.10%) and Mamont.od (5.05%, new).

Quarterly highlights: (1) AI-assisted malware - in July a malicious app in Brazil imitating Google Play Protect may have used AI to automate fraud, using the DistilBERT model to interpret natural-language commands from its C2 server (server-side commands may also have been LLM-generated); in August a Trojan used an on-device AI model, remotely updatable, to classify gallery images and screenshots to find banking data including CVV codes. (2) Trojan.AndroidOS.Subscriber.bh returned to Google Play disguised as a keyboard theme app, opening a subscription link in a hidden WebView and intercepting the confirmation SMS, mainly targeting users in Thailand. (3) iOS: in August Socket found 13 infected Composer/PHP theme packages on Packagist (vendor namespaces vsmov, vsphim, haiau009, chilltvcms, ophimcms) that inject JavaScript into Vietnamese movie and comic streaming sites running OphimCMS/KKPhim themes. Mobile visitors get an ad-fraud/gambling redirect chain; on iOS a hidden iframe fingerprints the iOS version and loads a version-specific exploit chain analogous to the DarkSword exploit kit (WebKit CVE-2025-31277 and CVE-2025-43529, WebContent-to-GPU-process sandbox escape, then a kernel escape via the AppleM2ScalerCSCDriver IOKit user client). Stolen data includes keychain databases, Wi-Fi passwords, SMS, address book, photos, cookies, call and location history, and from about 2026-08-12 an added keychain stealer for crypto wallet seeds (Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, OKX). Data is AES-encrypted and POSTed over HTTPS to /upload on a rotating pool of C2 domains, with progress beaconed to cloudfareintcdn.com/wd-status.html. Socket noted Funnull-hosted infrastructure and believes a Vietnamese-operated group is behind it, though who is behind the campaign is unclear. SlowMist reported the same DarkSword-style chain in FomoPeek, a fake App Store crypto-wallet tracker built to steal data from notes and crypto wallet apps (secondary reporting: versions 1.1/1.2 distributed Sept 9-17, about USD 580K in USDT traced to the attacker wallet, a figure that is wallet receipts rather than confirmed theft). (4) In August, infected versions of popular iOS apps were distributed via Telegram; users were asked to buy a developer certificate to install them, and the modified apps collected device information and screenshots and sent them to a server.

Background on DarkSword (Google Threat Intelligence Group, iVerify, Lookout; March 2026): a JavaScript full-chain iOS exploit kit and infostealer active since at least November 2025, using six vulnerabilities (CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520) against iOS 18.4-18.7 and deploying GHOSTBLADE, GHOSTKNIFE and GHOSTSABER payloads. It has been used by multiple actors (UNC6353 against Ukraine, UNC6748 against Saudi Arabia, PARS Defense against Turkey and Malaysia). The Kaspersky report itself names no threat actor, CVE, CVSS score or IOC (hash, domain, IP); indicators below are limited to values published by the cited third-party sources (Socket via The Hacker News, Google GTIG via The Hacker News) and to the detection verdict and package names stated in the report.

MITRE ATT&CK techniques by tactic:

Privilege Escalation

T1055 Process Injection

Execution

T1059.007 Command and Scripting Interpreter: JavaScript; T1204.002 User Execution: Malicious File

Command and Control

T1090 Proxy

Initial Access

T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools; T1659 Content Injection

privilege-escalation

T1404 Exploitation for Privilege Escalation

Discovery

T1418 Software Discovery; T1426 System Information Discovery

command-and-control

T1437.001 Application Layer Protocol: Web Protocols

Collection

T1513 Screen Capture; T1533 Data from Local System; T1636.004 Protected User Data: SMS Messages

Credential Access

T1555 Credentials from Password Stores

defense-evasion

T1630 Indicator Removal on Host; T1655.001 Masquerading: Match Legitimate Name or Location

Exfiltration

T1646 Exfiltration Over C2 Channel

initial-access

T1664 Exploitation for Initial Access

Remediation

Patches

• Apple iOS 18.6 (CVE-2025-31277)
• Apple iOS 18.7.2 / 26.1 (CVE-2025-43510, CVE-2025-43520)
• Apple iOS 18.7.3 / 26.2 (CVE-2025-43529, CVE-2025-14174)
• Apple iOS/macOS 26.3 (CVE-2026-20700)

Immediate actions

• Update iOS to the latest release (DarkSword-style chains target iOS 18.4-18.7 and earlier; fixes shipped in iOS 18.6, 18.7.2, 18.7.3, 26.1, 26.2, 26.3)
• Site operators using OphimCMS/KKPhim: check composer.lock for the 13 listed Packagist packages and remove them; audit Custom JS fields and jQuery/theme scripts
• Rotate credentials and crypto wallet seeds on devices or sites that may have been exposed; move assets to newly created wallets
• Remove FomoPeek and any sideloaded or Telegram-distributed iOS apps; do not buy developer certificates to install apps
• Block the published C2 domains cloudfareintcdn.com and snapshare.chat at DNS/proxy

Workarounds

• Enable Lockdown Mode on iOS devices that cannot be updated
• Install apps only from official stores and treat apps asking for accessibility, SMS or overlay permissions with suspicion
• Restrict installation from unknown sources on Android

Longer-term hardening

• Deploy mobile threat defense/EDR on managed Android and iOS devices and enable Google Play Protect
• Enforce MDM compliance policies requiring current OS versions
• Use Software Composition Analysis and Composer package pinning/allow-listing for PHP supply chains
• Buy Android devices from vendors that do not ship preinstalled Triada/Vo1d-class firmware; verify firmware provenance

Affected and fixed versions

• Google / Android OEMs — Android devices (including devices with preinstalled Triada/Vo1d firmware)
  Vulnerable versions: Devices exposed to Kaspersky-detected Mamont, Creduz, Triada, Vo1d, BTMOB, SpyNote
• Apple — iOS (iPhone XS through iPhone 16 per Socket)
  Vulnerable versions: iOS 18.4 through 18.7 and earlier per DarkSword reporting
  Fixed in: iOS 18.6; iOS 18.7.2; iOS 18.7.3; iOS 26.1; iOS 26.2; iOS 26.3
• OphimCMS / KKPhim — Composer theme packages on Packagist
  Vulnerable versions: 13 trojanized theme packages in vsmov, vsphim, haiau009, chilltvcms, ophimcms namespaces

Timeline

• 2025-11-01 DarkSword iOS exploit kit in use since at least November 2025 (UNC6748 Snapchat-themed campaign in Saudi Arabia; PARS Defense activity), per GTIG, iVerify and Lookout.
• 2025-12-01 UNC6353 (suspected Russian espionage group) used DarkSword in watering-hole attacks on compromised Ukrainian websites, targeting iOS 18.4-18.6.
• 2026-03-01 Socket first documents the Packagist campaign (month approximate): six malicious packages posing as OphimCMS themes serving a second-stage payload from Funnull-hosted infrastructure.
• 2026-03-19 GTIG, iVerify and Lookout publicly disclose DarkSword, a six-vulnerability JavaScript iOS exploit chain deploying GHOSTBLADE, GHOSTKNIFE and GHOSTSABER.
• 2026-07-01 In July (day approximate), a malicious app in Brazil imitating Google Play Protect is observed using the DistilBERT model to interpret natural-language C2 commands.
• 2026-08-12 Socket reports the Packagist iOS exploit chain redeployed around this date against iOS 18.4-18.6.x, adding a keychain stealer for crypto wallet seeds.
• 2026-08-15 In August (day approximate), a Trojan using an on-device, remotely updatable AI model to find banking data in gallery images is observed, and infected iOS apps are distributed via Telegram with a developer-certificate purchase lure.
• 2026-09-01 The Hacker News reports Socket's finding of 13 malicious Packagist theme packages across five vendor namespaces delivering the iOS exploit chain.
• 2026-09-09 FomoPeek versions 1.1 and 1.2 carrying hidden exploit modules distributed via the App Store between Sept 9 and 17, per secondary reporting of SlowMist's analysis.
• 2026-11-10 Kaspersky publishes the Q3 2026 mobile statistics report: 1,668,368 blocked attacks, 378,456 malicious packages, 119,688 banking Trojan packages.

Sources cited

• IT threat evolution in Q3 2026. Mobile statistics (Securelist, Anton Kivva) Kaspersky Securelist · Research · 2026-11-10
• IT threat evolution in Q2 2026. Mobile statistics (Securelist) Kaspersky Securelist · Research · 2026-08-01
• Socket: Packagist themes deliver iOS spyware socket.dev · Blog · 2026-08-31
• 13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds (The Hacker News) The Hacker News · News · 2026-09-01
• DarkSword iOS Exploit Kit Uses 6 Flaws (The Hacker News) The Hacker News · News · 2026-03-19
• Second iOS exploit kit emerges from suspected Russian hackers (CyberScoop) cyberscoop.com · News · 2026-03-19
• P7 DarkSword iOS Exploit Kit Adds (The Hacker News) The Hacker News · News · 2026-10-01
• FomoPeek App Store App Tied to $580K Crypto Theft After Sandbox Escape: SlowMist (Crowdfund Insider) crowdfundinsider.com · News · 2026-09-01
• iPhone crypto app hides malicious code, attacker wallet $580K (Bitcoin.com News) news.bitcoin.com · News · 2026-09-01
• Malicious Composer themes deliver spyware to unpatched iOS devices (SC Media) scworld.com · News · 2026-09-01

More in malware

• Blind Eagle (APT-C-36) Uses Fake Court Notices to Deliver AsyncRAT/DCRat-Lineage RAT Across Latin America
• GhostFrame: New ESXi Post-Exploitation Implant Linked to TAG-218 / Settra Ransomware
• Formbook (XLoader) Campaign Targets European Manufacturing and Technology Businesses with Localized Order Lures
• iVerify Advanced Mobile Threat Report 2026: Mobile Spyware Shifts Toward Everyday Users as Criminal Groups Fork Leaked iOS Exploit Kits for Credential and Crypto Theft
• Kaspersky Q3 2026 Non-Mobile Threat Landscape: Qilin Ransomware via CVE-2026-0257, INC Ransom via SonicWall SMA1000 CVE-2026-15409/15410, macOS Stealers (PamStealer, MacSync, Overlord) and npm/PyPI/crates.io Supply-Chain Backdoors

Other reports on CVE-2025-31277

• Coruna and DarkSword iOS Spyware Delivered via Instagram Ads, Hijacked Expired Ad/Analytics Domains and Compromised PrestaShop Stores (DeadTag)
• Coruna and DarkSword iOS Exploit Kits Compromise iPhones via Single Malicious Website (UNC6353, UNC6691, UNC6748, PARS Defense)
• DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors (CVE-2026-20700, CVE-2025-43529, CVE-2025-31277)

Other reports on CVE-2025-43529

• APT29 (Midnight Blizzard) watering holes target iOS and Android devices with n-day exploit chains (DarkSword, AndroSnitch)
• Apple Zero-Day CVE-2026-20700: Memory Corruption Enabling Arbitrary Code Execution — Google TAG-Discovered 'Extremely Sophisticated' Targeted Attack

Further reading

• OpenClaw AI Agent Threat Landscape: 8 Attacks
• OpenCode AI Coding Agent: 8 Attack Vectors