# Kaspersky Q3 2026 Mobile Threat Statistics: Mamont/Creduz banker droppers, Triada/Vo1d preinstalled malware, AI-assisted Android fraud, DarkSword iOS exploit kit

> Securelist's Q3 2026 mobile report records 1,668,368 blocked attacks (down from 1,996,823 in Q2) but 378,456 malicious installation packages, 119,688 of them banking Trojans. Trojan-Banker was the top category (31.63%), droppers delivering Mamont and Creduz rose sharply, and Vo1d.b and Triada variants led the top 20. The report also covers AI-assisted Android malware and the DarkSword iOS exploit kit delivered through 13 infected Packagist packages and the FomoPeek fake App Store app.

- **Published:** 2026-11-10T08:54:30Z
- **Last reviewed:** 2026-11-10T08:54:30Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5629
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5629.png
- **ID:** TL-2026-5629
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 29 (2 shown free below)
- **CVEs:** CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520

## Description

Kaspersky's Q3 2026 mobile statistics report (Securelist, Anton Kivva, 2026-11-10, based on Kaspersky Security Network telemetry from consenting users) records 1,668,368 blocked attacks involving mobile malware, adware or unwanted software, down about 16.5% from 1,996,823 in Q2. Detected malicious Android installation packages rose to 378,456, of which 119,688 were mobile banking Trojans. Trojan-Banker was the most prevalent category at 31.63% of detected malicious apps, and standalone banking Trojans plus droppers made up more than half of all detected malicious apps. Trojan-Dropper detections rose sharply because droppers deliver known bankers such as Mamont and Creduz. Creduz has the largest share by type, while Mamont variants were the most active in actual attacks. Adware (HiddenAd, MobiDash) declined but still ranks first by number of attacked users. Among Trojan-Spy attacks the largest growth came from BTMOB and SpyNote RAT.

Top-20 verdicts by unique users were led by the preinstalled backdoor Backdoor.AndroidOS.Triada.ag (13.14%, up from 9.35%), followed by Trojan.AndroidOS.Boogr.gsh (5.21%), DangerousObject.AndroidOS.GenericML (4.61%) and DangerousObject.Multi.Generic (4.01%). The main newcomer was Trojan-Proxy.AndroidOS.Vo1d.b (0.07% to 3.20%), delivered by preinstalled Trojans, which turns devices into VPN exit nodes, consuming users' data and enabling illegal activity in the victim's name; Trojan.AndroidOS.Vo1d.c also entered at 2.16%. New droppers entered the list: Trojan-Dropper.AndroidOS.Mamont.am (2.72%), Mamont.aq (2.03%) and Creduz.t (1.30%), alongside Trojan-Dropper.AndroidOS.BeatBanker.c (1.33%) and Trojan-Spy.AndroidOS.Btmob.c (2.09%, up 22 places). In the top-10 bankers, Trojan-Banker.AndroidOS.Mamont.hl led (10.31%), followed by Agent.ws (7.42%), Agent.eq (5.58%), Mamont.lf (5.10%) and Mamont.od (5.05%, new).

Quarterly highlights: (1) AI-assisted malware - in July a malicious app in Brazil imitating Google Play Protect may have used AI to automate fraud, using the DistilBERT model to interpret natural-language commands from its C2 server (server-side commands may also have been LLM-generated); in August a Trojan used an on-device AI model, remotely updatable, to classify gallery images and screenshots to find banking data including CVV codes. (2) Trojan.AndroidOS.Subscriber.bh returned to Google Play disguised as a keyboard theme app, opening a subscription link in a hidden WebView and intercepting the confirmation SMS, mainly targeting users in Thailand. (3) iOS: in August Socket found 13 infected Composer/PHP theme packages on Packagist (vendor namespaces vsmov, vsphim, haiau009, chilltvcms, ophimcms) that inject JavaScript into Vietnamese movie and comic streaming sites running OphimCMS/KKPhim themes. Mobile visitors get an ad-fraud/gambling redirect chain; on iOS a hidden iframe fingerprints the iOS version and loads a version-specific exploit chain analogous to the DarkSword exploit kit (WebKit CVE-2025-31277 and CVE-2025-43529, WebContent-to-GPU-process sandbox escape, then a kernel escape via the AppleM2ScalerCSCDriver IOKit user client). Stolen data includes keychain databases, Wi-Fi passwords, SMS, address book, photos, cookies, call and location history, and from about 2026-08-12 an added keychain stealer for crypto wallet seeds (Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, OKX). Data is AES-encrypted and POSTed over HTTPS to /upload on a rotating pool of C2 domains, with progress beaconed to cloudfareintcdn.com/wd-status.html. Socket noted Funnull-hosted infrastructure and believes a Vietnamese-operated group is behind it, though who is behind the campaign is unclear. SlowMist reported the same DarkSword-style chain in FomoPeek, a fake App Store crypto-wallet tracker built to steal data from notes and crypto wallet apps (secondary reporting: versions 1.1/1.2 distributed Sept 9-17, about USD 580K in USDT traced to the attacker wallet, a figure that is wallet receipts rather than confirmed theft). (4) In August, infected versions of popular iOS apps were distributed via Telegram; users were asked to buy a developer certificate to install them, and the modified apps collected device information and screenshots and sent them to a server.

Background on DarkSword (Google Threat Intelligence Group, iVerify, Lookout; March 2026): a JavaScript full-chain iOS exploit kit and infostealer active since at least November 2025, using six vulnerabilities (CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520) against iOS 18.4-18.7 and deploying GHOSTBLADE, GHOSTKNIFE and GHOSTSABER payloads. It has been used by multiple actors (UNC6353 against Ukraine, UNC6748 against Saudi Arabia, PARS Defense against Turkey and Malaysia). The Kaspersky report itself names no threat actor, CVE, CVSS score or IOC (hash, domain, IP); indicators below are limited to values published by the cited third-party sources (Socket via The Hacker News, Google GTIG via The Hacker News) and to the detection verdict and package names stated in the report.

## MITRE ATT&CK

- T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools
- T1664 Exploitation for Initial Access
- T1659 Content Injection
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1204.002 User Execution: Malicious File
- T1404 Exploitation for Privilege Escalation
- T1055 Process Injection
- T1655.001 Masquerading: Match Legitimate Name or Location
- T1630 Indicator Removal on Host
- T1555 Credentials from Password Stores
- T1418 Software Discovery
- T1426 System Information Discovery
- T1636.004 Protected User Data: SMS Messages
- T1513 Screen Capture
- T1533 Data from Local System
- T1437.001 Application Layer Protocol: Web Protocols
- T1090 Proxy
- T1646 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Mamont/Creduz/BeatBanker Android Dropper and Banker Verdicts in AV Telemetry** (`TL-2026-5629-SPL-002`)

Detects Kaspersky endpoint/mobile verdicts for the Android banker droppers and bankers featured in the Q3 2026 Securelist mobile report: Trojan-Dropper Mamont (.am, .aq), Creduz (.t), BeatBanker (.c), Trojan-Banker Mamont (.hl, .lf, .od) and Agent (.ws, .eq), plus Subscriber.bh (hidden-WebView subscription fraud with SMS interception). Also flags the community-observed APK sha256 312ccddf... from OSINT sibling indicators. Indicates user-executed malicious app install (T1204.002), disguised apps (T1655.001) and SMS interception (T1636.004).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1655.001, T1636.004
- **Data sources:** Kaspersky Security Center CEF (index=av, sourcetype=cef), CommonSecurityLog (Kaspersky CEF connector), antivirus logsource
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=av sourcetype="cef" earliest=-24h ("Kaspersky" OR "312ccddffce813529d27c0962b140c031e6d7e8aa8eec3f4c6ada40d16d775d0")
```Verdict names from the Securelist Q3 2026 mobile statistics plus one community-tier sha256```
| regex _raw="(?i)(Trojan-Dropper[.]AndroidOS[.](Mamont|Creduz|BeatBanker)[.][a-z]+|Trojan-Banker[.]AndroidOS[.](Mamont[.][a-z]+|Agent[.](ws|eq))|Trojan[.]AndroidOS[.]Subscriber[.]bh|312ccddffce813529d27c0962b140c031e6d7e8aa8eec3f4c6ada40d16d775d0)"
| rex field=_raw "(?<verdict>Trojan(-[A-Za-z]+)?[.]AndroidOS[.][A-Za-z0-9]+[.][a-z0-9]+)"
| eval verdict=coalesce(verdict, "community_sha256_match")
| stats count min(_time) as first_seen max(_time) as last_seen values(src) as src values(dest) as dest values(user) as user by host, verdict
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen host verdict count src dest user
````

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor has 'Kaspersky' or tostring(AdditionalExtensions) has '312ccddffce813529d27c0962b140c031e6d7e8aa8eec3f4c6ada40d16d775d0'
| extend Raw = strcat(Activity, ' ', Message, ' ', FileName, ' ', tostring(AdditionalExtensions))
| where Raw matches regex @'(?i)(Trojan-Dropper[.]AndroidOS[.](Mamont|Creduz|BeatBanker)[.][a-z]+|Trojan-Banker[.]AndroidOS[.](Mamont[.][a-z]+|Agent[.](ws|eq))|Trojan[.]AndroidOS[.]Subscriber[.]bh|312ccddffce813529d27c0962b140c031e6d7e8aa8eec3f4c6ada40d16d775d0)'
| extend Verdict = coalesce(extract(@'(?i)(Trojan(?:-[A-Za-z]+)?[.]AndroidOS[.][A-Za-z0-9]+[.][a-z0-9]+)', 1, Raw), 'community_sha256_match')
| project TimeGenerated, DeviceVendor, DeviceProduct, Computer, SourceUserName, Verdict, Activity, Message
```

### Sigma

```yaml
title: Android Banker Dropper and Banker Verdicts (Mamont, Creduz, BeatBanker, Subscriber)
id: b83f7d51-0a96-4e2c-95b4-1c6d3a8e07f9
status: experimental
description: Detects antivirus/mobile-protection verdicts for Mamont, Creduz and BeatBanker droppers, Mamont and Agent banking Trojans and Subscriber.bh named in the Kaspersky Q3 2026 mobile threat statistics report.
references:
  - https://securelist.com/malware-report-q3-2026-mobile-statistics/121844/
author: Threadlinqs Team
date: 2026-11-10
tags:
  - attack.execution
  - attack.t1204.002
  - attack.defense-evasion
  - attack.t1655.001
  - attack.collection
  - attack.t1636.004
logsource:
  product: antivirus
detection:
  selection:
    Signature|contains:
      - 'Trojan-Dropper.AndroidOS.Mamont'
      - 'Trojan-Dropper.AndroidOS.Creduz'
      - 'Trojan-Dropper.AndroidOS.BeatBanker'
      - 'Trojan-Banker.AndroidOS.Mamont'
      - 'Trojan-Banker.AndroidOS.Agent.ws'
      - 'Trojan-Banker.AndroidOS.Agent.eq'
      - 'Trojan.AndroidOS.Subscriber.bh'
  condition: selection
falsepositives:
  - Security teams detonating known Android samples in a lab with AV telemetry forwarded
  - Test detections using EICAR-style Android samples named after these families
level: high
```

**Known false positives:**

- Malware analysts or sandboxes forwarding AV telemetry for detonated samples
- Retroactive re-scans that re-report already quarantined detections

**Tuning notes:** Adjust index/sourcetype to wherever Kaspersky Security Center or your MTD product forwards events; verdict naming differs per vendor, so add vendor aliases (for example Defender Trojan:AndroidOS/Mamont). The sha256 is community-tier (OSINT sibling) and should be treated as corroboration only. Suppress lab hosts by host/user allow-list.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Composer Command Installing Trojanized OphimCMS/KKPhim Theme Package (locked: unlock with TL Creds)
- Preinstalled Triada/Vo1d Backdoor/Proxy and BTMOB/SpyNote Spyware Alerts (locked: unlock with TL Creds)
- Rotating C2 Pool: Large POST /upload to First-Seen Host (DarkSword-Style Encrypted Exfiltration) (locked: unlock with TL Creds)
- Unpatched iOS 18.4-18.7 Device Contacting DarkSword Exploit-Chain Infrastructure (locked: unlock with TL Creds)
- Vulnerable iOS Client POSTing Encrypted Data to /upload (Keychain and Wallet-Seed Exfiltration) (locked: unlock with TL Creds)
- DNS Resolution of DarkSword and Fake Google Play Infrastructure Domains (locked: unlock with TL Creds)
- Trojanized Packagist OphimCMS/KKPhim Theme Package Retrieval (DarkSword iOS Chain Delivery) (locked: unlock with TL Creds)
- DarkSword Progress Beacon and Encrypted Upload to Known C2 Infrastructure ([indicator], [indicator]) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 29)

Defanged, TLP:CLEAR.

- Domain: `cloudfareintcdn[.]com`
- Domain: `snapshare[.]chat`

Full set of 29 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [IT threat evolution in Q3 2026. Mobile statistics (Securelist, Anton Kivva)](https://securelist.com/malware-report-q3-2026-mobile-statistics/121844/)
- [IT threat evolution in Q2 2026. Mobile statistics (Securelist)](https://securelist.com/malware-report-q2-2026-mobile-statistics/120948/)
- [13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds (The Hacker News)](https://thehackernews.com/2026/09/13-malicious-packagist-packages-target.html)
- [Socket: Packagist themes deliver iOS spyware](https://socket.dev/blog/packagist-themes-ios-spyware)
- [DarkSword iOS Exploit Kit Uses 6 Flaws (The Hacker News)](https://thehackernews.com/2026/03/darksword-ios-exploit-kit-uses-6-flaws.html)
- [Second iOS exploit kit emerges from suspected Russian hackers (CyberScoop)](https://cyberscoop.com/second-ios-exploit-kit-emerges/)
- [P7 DarkSword iOS Exploit Kit Adds (The Hacker News)](https://thehackernews.com/2026/10/p7-darksword-ios-exploit-kit-adds.html)
- [FomoPeek App Store App Tied to $580K Crypto Theft After Sandbox Escape: SlowMist (Crowdfund Insider)](https://www.crowdfundinsider.com/2026/09/312310-fomopeek-app-store-app-tied-to-580k-crypto-theft-after-sandbox-escape-slowmist/)
- [iPhone crypto app hides malicious code, attacker wallet $580K (Bitcoin.com News)](https://news.bitcoin.com/security/iphone-crypto-app-hides-malicious-code-attacker-wallet-580k/)
- [Malicious Composer themes deliver spyware to unpatched iOS devices (SC Media)](https://scworld.com/brief/malicious-composer-themes-deliver-spyware-to-unpatched-ios-devices)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5629