Mobile Malware Soars in Q3 2025: Key Insights from Kaspersky's Global Report
Executive Summary
In Q3 2025, Kaspersky reported a significant surge in mobile malware activity, with 47 million attacks prevented globally targeting Android devices with Trojans, adware, banking malware, and ransomware. Threat actors exploited new variants—including BADBOX and sophisticated Trojans like Triada and Fakemoney—utilizing methods such as pre-installed backdoors and malicious app mods. Mobile banking Trojans (especially Mamont and Coper) and region-targeted malware attacks in Turkey, India, Iran, and Germany impacted financial data security and user privacy, highlighting expanding attacker sophistication and supply chain compromise.
This incident is critical as it illustrates the rising prevalence and complexity of mobile threats, coinciding with increased ransomware attacks and evolving delivery channels. The continued targeting of financial apps and global user bases signals an urgent need for organizations to strengthen mobile security, visibility, and compliance with privacy mandates.
Why This Matters Now
Mobile malware campaigns are evolving rapidly, with attackers leveraging preinstallation, supply chain vulnerabilities, and increasingly advanced Trojans to bypass user protections. Organizations face heightened risks as threat actors shift focus to mobile-first exploits, ransomware, and financial fraud, making proactive defense and regulatory compliance more urgent than ever.
Attack Path Analysis
Attackers initially compromised mobile devices through supply-chain attacks (such as preloaded backdoors or malicious app modifications). They escalated privileges by exploiting dropped payloads and loaders embedded within system processes. Once established, the threat actors performed lateral movement by leveraging interconnected services, abusing process injection and cross-app communication. Command and control was maintained using covert outbound connections, often encrypted or leveraging VPN-like modules. Exfiltration of sensitive data or monetization was conducted via malicious modules that manipulated internet access, clicked ads, or siphoned financial information. The impact included data theft, financial fraud, artificial ad inflation, and ransomware deployment leading to device disruption.
Kill Chain Progression
Initial Compromise
Description
Attackers delivered malware via preloaded system backdoors or via sideloaded malicious apps (e.g., infected messaging app mods, repacked APKs), enabling code execution on mobile endpoints.
Related CVEs
CVE-2025-40991
CVSS 5.1Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 allows remote attackers to steal session details via the 'description' parameter.
Affected Products:
Creativeitem Ekushey CRM – 5.0
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Deliver Malicious App via Authorized App Store
Supply Chain Compromise
Exploitation for Privilege Escalation
Credential Access
Data from Local System
Input Capture
Access Sensitive Data in Device Logs
Endpoint Denial of Service
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Malicious Software Prevention Mechanisms
Control ID: 6.2.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA (Digital Operational Resilience Act) – Information and Communication Technology (ICT) Risk Management
Control ID: Article 9
CISA Zero Trust Maturity Model 2.0 – Device Security Monitoring and Enforcement
Control ID: Pillar: Device, Capability: Inventory and Security Posture
NIS2 Directive – Cybersecurity Risk Management and Reporting
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Banking/Mortgage
Mobile banking Trojans like Mamont and Coper directly target financial institutions with 52,723 malicious packages detected, requiring enhanced mobile security frameworks.
Financial Services
Widespread banking malware attacks across Turkey, India, and Germany threaten payment systems and customer data, demanding zero trust segmentation implementation.
Telecommunications
Mobile network infrastructure faces threats from BADBOX backdoors and Triada variants affecting device-level security, requiring encrypted traffic monitoring capabilities.
Information Technology/IT
IT organizations must address 47 million mobile malware attacks including ransomware and adware campaigns targeting enterprise mobility management systems.
Sources
- IT threat evolution in Q3 2025. Mobile statisticshttps://securelist.com/malware-report-q3-2025-mobile-statistics/118013/Verified
- NVD - CVE-2025-40991https://nvd.nist.gov/vuln/detail/CVE-2025-40991Verified
- Mobile threat report for Q1 2025 | Securelisthttps://securelist.com/malware-report-q1-2025-mobile-statistics/116676/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Cloud Network Security Framework (CNSF) controls, especially those enabling zero trust segmentation, east-west monitoring, egress filtering, and encrypted traffic enforcement, could have restricted the spread and communication of mobile malware—limiting compromise impact, containing threats, and aiding rapid detection.
Control: Zero Trust Segmentation
Mitigation: Lateral malware introduction paths are blocked or tightly controlled.
Control: Multicloud Visibility & Control
Mitigation: Detection of privilege escalation behaviors and system policy violations.
Control: East-West Traffic Security
Mitigation: Lateral traffic is monitored and segmented, detecting and preventing unauthorized moves.
Control: Egress Security & Policy Enforcement
Mitigation: Outbound malicious traffic is filtered or blocked.
Control: Encrypted Traffic (HPE)
Mitigation: Sensitive data is protected and monitored in transit, restricting unauthorized exfiltration.
Rapid detection and alerting on ransomware-like or anomalous behaviors minimize impact.
Impact at a Glance
Affected Business Functions
- Customer Relationship Management
Estimated downtime: 3 days
Estimated loss: $50,000
Potential exposure of customer data, including contact information and communication history.
Recommended Actions
Key Takeaways & Next Steps
- • Enforce zero trust segmentation and microsegmentation to isolate potentially compromised mobile devices and minimize the blast radius.
- • Deploy egress filtering and domain-based controls to prevent malicious C2 traffic and unauthorized data exfiltration from endpoints and service environments.
- • Implement east-west traffic inspection to detect and disrupt lateral movement and process injection by mobile malware within apps and workloads.
- • Increase centralized visibility and adopt anomaly detection to rapidly identify privilege escalation, ad fraud modules, or ransomware behavior in cloud-connected devices.
- • Ensure all sensitive outbound traffic is encrypted at line rate and monitored for unexpected transmissions to mitigate data theft and financial fraud.
