The mobile malware threat landscape in 2023

The figures above are based on detection statistics received from Kaspersky users who consented to sharing usage data with Kaspersky Security Network. The data for years preceding 2023 may differ from that published previously, as the calculation methodology was refined, and the data was retrospectively revised in 2023.

The year in figures

According to Kaspersky Security Network, in 2023:

• Our solutions blocked almost 33.8 million malware, adware, and riskware attacks.

• The most common threat to mobile devices was adware: 40.8% of all threats detected.
• We detected more than 1.3 million malicious installation packages, 154,000 of these containing a mobile banking Trojan.

The year’s trends

Malware, adware, and riskware attacks on mobile devices dipped in February, only to rise steadily until the end of the year. In total, Kaspersky products blocked 33,790,599 attacks in 2023.

Number of attacks targeting users of Kaspersky mobile solutions, 2021–2023 (download)

Malware kept making its way into Google Play every now and then. For example, in 2023, we discovered that the marketplace contained a malicious application, Trojan.AndroidOS.Agent.wr, camouflaged as a file manager (see the image below).

The app decrypted and executed reverse proxy code, and displayed ads.

Both Google Play and third-party marketplaces were flooded with fake investment apps that relied on social engineering to coax personal data out of users: mostly phone numbers and full names, which were later added to databases used for phone fraud.

Also in 2023, we detected malicious WhatsApp and Telegram modifications that were stealing user data.

Mobile threat statistics

The number of new unique malware and riskware installation packages decreased slightly from 2022’s levels to 1,315,405.

Distribution of detected installation packages by type

Distribution of newly detected mobile malware by type in 2022 and 2023 (download)

Adware and RiskTool topped the rankings as usual. MobiDash (35.2%) was 2023’s most popular adware family, followed by Adlo (9.4%) and HiddenAd (9%).

Share of users attacked by the specific malware or riskware type in total Kaspersky users* attacked in 2022 and 2023 (download)

* These percentages may not add up to 100% if the same users encountered more than one type of attack.

The Trojan-SMS-type malware saw its activity decrease significantly, dropping six positions from 2022. By contrast, adware activity on user devices increased.

TOP 20 most frequently detected mobile malware programs

Note that the malware rankings below exclude riskware or PUAs, such as RiskTool or adware.

* Unique users who encountered this malware as a percentage of all attacked users of Kaspersky mobile solutions.

Many malware families that were not in 2022’s top 20 joined the list in 2023.

The generalized cloud verdict DangerousObject.Multi.Generic (14.82%), which covers malware from several different families, unsurprisingly retains the top spot. The umbrella ML verdict Trojan.AndroidOS.Boogr.gsh (6.81%) was also close to the top positions.

Trojan.AndroidOS.Fakemoney.v (11.76%), in second place, represents investment and payout scam apps. Another scam app variety, Trojan.AndroidOS.GriftHorse.l (5.73%), that tricked users into buying subscriptions disguised as weight loss plans, was fourth.

A number of malicious WhatsApp mods hit the top 20 list: Trojan.AndroidOS.Triada.et (4.83%), Trojan.AndroidOS.Triada.ex (3.31%), as well as Trojan-Spy.AndroidOS.CanesSpy.a (1.79%) and Trojan-Spy.AndroidOS.Agent.afq (3.18%).

The banking Trojan packer Trojan-Dropper.AndroidOS.Badpack.g (2.75%) was tenth.

Curiously, Trojan-Dropper.AndroidOS.Agent.uc (2.30%) joined the rankings as well. Detected mostly on smart TVs, this dropper is used for hidden deployments of the Mirai bot, which targets Android devices.

Region-specific malware

In this section, we describe malware that predominantly attacks users in specific countries.

* Country where the malware was most active.
* Unique users who encountered the malware in the indicated country as a percentage of all Kaspersky mobile security solution users attacked by the same malware.

Users in Turkey experienced the greatest variety of threats concentrated within a single country in 2023. These included BrowBot, GodFather, and Sova banking Trojan modifications; SmsThief.tp spies; Fakeapp.e SMS Trojans; and the Tambir backdoor. Tambir opens VNC access for malicious actors, functions as a keylogger, steals SMS messages, contacts, and app lists, and sends SMS messages.

Also, several specialized threats were active in Brazil, including the Banbra and Brats banking Trojans, which we mentioned in several previous reports.

The SmsThief and SmsEye spies were mostly spread in Indonesia. Fakeapp.g, a program that opens the website of a third-party app store while sending SMS messages to short codes, specialized in attacking users in Thailand.

Mobile banking Trojans

The number of new banking Trojan installation packages dropped slightly from 2022’s level to 153,682.

The number of mobile banking Trojan installation packages detected by Kaspersky in 2020–2023 (download)

TOP 10 mobile bankers

* Unique users who encountered this malware as a percentage of all Kaspersky mobile security solution users who encountered banking threats.

The total number of banking Trojan attacks remained at 2022’s level despite a slight decrease in the number of unique installation packages. This suggests that malicious actors were more likely to reuse the same malware for attacking new users than in the previous year.

Mobile ransomware Trojans

The number of new ransomware installation packages increased slightly year-on-year, reaching 11,202.

Number of installation packages for mobile ransomware detected by Kaspersky, 2020–2023 (download)

TOP 10 mobile ransomware Trojan apps

* Unique users who encountered this malware as a percentage of all Kaspersky mobile security solution users attacked by ransomware Trojans.

The Rasket Trojan (52.39%) topped the rankings of similar Trojans in terms of attacks by pushing out Pigertl (22.30%). The rest of the positions were, as usual, occupied by various modifications of Rkor, Congur, Small, and Svpeng Trojans, which had been active for a long time.

Conclusion

Android malware and riskware activity surged in 2023 after two years of relative calm, returning to early 2021 levels by the end of the year. That said, the number of unique installation packages dropped from 2022, suggesting that malicious actors were more frequently using the same packages to infect different victims. Adware accounted for the majority of threats detected in 2023.

Attackers continued to use official app marketplaces, such as Google Play, to spread malware. Also, we repeatedly detected malicious mods of popular instant messaging apps.