A family of Android Trojans that turns an infected device into a relay for strangers' internet traffic went from almost nowhere to the fifth most common mobile threat in a single quarter, according to Kaspersky's Q3 2026 mobile threat report, written by researcher Anton Kivva.
The detection, Trojan-Proxy.AndroidOS.Vo1d.b, was seen by 0.07% of attacked Kaspersky mobile users in Q2. In Q3 that figure was 3.20%. A sibling variant, Trojan.AndroidOS.Vo1d.c, appeared in the top 20 for the first time at 2.16%. Kaspersky says the apps are delivered by preinstalled Trojans and turn the device into an exit node of a VPN service.
Somebody else's traffic, your device's address
Kaspersky names two harms. The first is cost: the device burns through internet traffic, which its owner may be paying for, to relay other people's data. The second is legal exposure: criminals can use the infected device to attack online services and visit banned websites, breaking the law in the victim's name, because the traffic leaves from the victim's connection.
The preinstalled route matters. Malware that ships on the device before the buyer switches it on cannot be avoided by being careful in an app store, which is the same problem behind cheap Android phones that ship with malware you cannot remove. The top of Kaspersky's list tells the same story: Backdoor.AndroidOS.Triada.ag, a variant of the preinstalled Triada Trojan, rose from 9.35% to 13.14% of attacked users and holds first place.
Banking Trojans start reading photos
Kaspersky highlights two Android banking threats that brought machine learning into the fraud itself. In July it found a malicious app aimed at Brazilian users and disguised as Google Play Protect, whose code used the DistilBERT language model to interpret natural-language commands from its command server. Traces in the code suggest those server-side commands may also have been generated by a large language model, which Kaspersky frames as a possibility rather than a finding.
In August it found a Trojan that ran an on-device AI model to classify images in the phone's gallery and took screenshots, looking for banking data including CVV codes. The operators could update that model remotely, giving them a way to extend what the Trojan looks for.
Banking malware remains the core business. Trojan-Banker was the most prevalent category at 31.63% of detected malicious apps, and Kaspersky counted 119,688 banking Trojan installation packages among 378,456 malicious packages overall. Droppers that wrap known bankers such as Mamont and Creduz drove a sharp rise in the Trojan-Dropper category, continuing the packaging trend Kaspersky flagged last quarter and that we covered in our Q2 report. Mamont variants were again the most active bankers in real attacks, and the BTMOB and SpyNote spyware families grew fastest among Trojan-Spy detections.
Overall attack volume kept falling, to 1,668,368 blocked attacks in Q3 from 1,996,823 in Q2, partly because adware declined.
iPhone users were not left out
The report also notes iOS activity. Researchers at Socket found 13 infected PHP packages in the Packagist repository that injected casino spam into sites and, on iOS devices only, a hidden iframe loading the DarkSword exploit kit, previously seen behind a fake iPhone preorder page. SlowMist found the same chain inside FomoPeek, an App Store app posing as a crypto wallet tracker. Kaspersky separately found trojanized iOS apps spread through Telegram, where victims were asked to buy a developer certificate to install them.
Buy known brands and refuse sideloading
Kaspersky's report does not publish IoCs for these families. For defenders, the practical lessons are to avoid off-brand Android devices and TV boxes with unknown firmware provenance, to keep Google Play Protect enabled, to treat any app that asks to be installed from outside the official store with suspicion, and to treat a request to buy a developer certificate as a red flag on its own. Watch network usage too: a device relaying VPN traffic for strangers may show data consumption its owner cannot explain.
The quarter's numbers point one way. Fewer attacks overall, but the ones that grew are those a careful user cannot click their way out of.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.