Mobile malware evolution 2021

Mobile malware evolution 2021

These statistics are based on detection verdicts of Kaspersky products received from users who consented to providing statistical data.


Figures of the year


In 2021, Kaspersky mobile products and technologies detected:


3,464,756 malicious installation packages
97,661 new mobile banking Trojans
17,372 new mobile ransomware Trojans

Trends of the year


In 2021, we observed a downward trend in the number of attacks on mobile users. But it is too early to celebrate: attacks are becoming more sophisticated in terms of both malware functionality and vectors.


Last year saw repeat incidents of malicious code injection into popular apps through ad SDKs, as in the sensational case of CamScanner — we found malicious code inside ad libraries in the official APKPure client, as well as in a modified WhatsApp build.


Experts also continued to find malware in apps on Google Play, despite Google’s efforts to keep threats off the platform. Especially notable in 2021 were the Joker Trojan, which signs victims up to paid subscriptions, the Facestealer Trojan, which steals credentials from Facebook accounts, and various banking Trojan loaders. The most common way to sneak malware onto Google Play is for a Trojan to mimic a legitimate app already published on the site (for example, a photo editor or a VPN service) with the addition of a small piece of code to decrypt and launch a payload from the Trojan’s body or download it from the attackers’ server. Often, to complicate dynamic analysis, unpacking actions are performed through commands from the attackers’ server and in several steps: each decrypted module contains t ..

Support the originator by clicking the read the rest link below.