These statistics are based on detection alerts from Kaspersky products, collected from users who consented to provide statistical data to Kaspersky Security Network. The statistics for previous years may differ from earlier publications due to a data and methodology revision implemented in 2024.

The year in figures

According to Kaspersky Security Network, in 2024:

• A total of 33.3 million attacks involving malware, adware or unwanted mobile software were prevented.
• Adware, the most common mobile threat, accounted for 35% of total detections.
• A total of 1.1 million malicious and potentially unwanted installation packages were detected, almost 69,000 of which associated with mobile banking Trojans.

The year’s trends

In 2024, cybercriminals launched a monthly average of 2.8 million malware, adware or unwanted software attacks targeting mobile devices. In total, Kaspersky products blocked 33,265,112 attacks in 2024.

Attacks on Kaspersky mobile users in 2024 (download)

At the end of 2024, we discovered a new distribution scheme for the Mamont banking Trojan, targeting users of Android devices in Russia. The attackers lured users with a variety of discounted products. The victim had to send a message to place an order. Some time later, the user received a phishing link to download malware disguised as a shipment tracking app.

The phishing link as seen in the chat with the fraudsters

See translation
Your order has shipped.
42609775
Your order tracking code.
You can track your order in the mobile app:
https://.pilpesti573.ru/page/e5d565fdfd7ce
Tracker
To pay for your order AFTER YOU RECEIVE IT, enter your tracking code IN THE APP above and wait for your order details to load. We recommend keeping the app open while you are doing so. Loading the track code may take more than 30 minutes.

In August 2024, researchers at ESET described a new NFC banking scam discovered in the Czech Republic. The scammers employed phishing websites to spread malicious mods of the legitimate app NFCGate. These used a variety of pretexts to persuade the victim to place a bank card next to the back of their phone for an NFC connection. The card details were leaked to the fraudsters who then made small contactless payments or withdrew money at ATMs.

A similar scheme was later spotted in Russia, where malware masqueraded as banking and e-government apps. The SpyNote RAT was occasionally used as the malware dropper and NFC activator.

A screenshot of the fake mobile app

See translation
Hold your card against the NFC contactless payment module for verification.
Ready to scan

Also in 2024, we detected many new preinstalled malicious apps that we assigned the generalized verdict of Trojan.AndroidOS.Adinstall. A further discovery, made in July, was the LinkDoor backdoor, also known as Vo1d, installed on Android-powered TV set-top boxes. It was located inside an infected system application com.google.android.services. The malware was capable of running arbitrary executables and downloading and installing any APKs.

On top of the above, we discovered several apps on Google Play, each containing a malicious SDK implant named “SparkCat”, which began to spread at least as early as March 2024. Infected apps were deleted by the store in February 2025: nevertheless, our telemetry data shows that other apps containing SparkCat are distributed through unofficial sources.

This SDK received a C2 server command with a list of keywords or dictionaries to search the gallery on the device for images to exfiltrate. Our data suggests that the Trojan was aimed at stealing recovery phrases for cryptocurrency wallets of Android users primarily in the UAE, Europe and Asia.

It is worth noting that the same implant for iOS was delivered via the App Store, which makes it the first known OCR malware to sneak into Apple’s official marketplace. Apple removed the infected apps in February 2025.

Mobile threat statistics

We discovered 1,133,329 malicious and potentially unwanted installation packages in 2024. This was below the 2023 figure, but the difference was smaller than the year before. The trend in the number of new unique malware installation packages appears to be plateauing.

Detected Android-specific malware and unwanted software installation packages in 2021–2024 (download)

Detected packages by type

Detected mobile apps by type in 2023 and 2024 (download)

Adware and RiskTool apps continued to dominate the rankings of detected threats by type. The BrowserAd (22.8%), HiddenAd (20.3%) and Adlo (16%) families accounted for the largest number of new installation packages in the former category. RiskTool’s share grew largely due to an increase in the number of Fakapp pornographic apps.

Share* of users attacked by the given type of malware or unwanted software out of all targeted Kaspersky mobile users in 2023–2024 (download)

*The total may exceed 100% if the same users experienced multiple attack types.

Banking Trojans gained three positions as compared with 2023 to occupy fourth place, following the usual leaders: adware, Trojans, and RiskTool.

TOP 20 most frequently detected types of mobile malware

Note that the malware rankings below exclude riskware and potentially unwanted apps, such as adware and RiskTool.

* Share of unique users who encountered this malware as a percentage of all attacked Kaspersky mobile users

Fakemoney, a family of investment and payout scam apps, showed the highest level of activity in 2024. Third-party WhatsApp mods with the Triada.ga embedded Trojan were third, following the generalized cloud-specific verdict of DangerousObject.Multi.Generic. Many other messaging app mods in the same family, namely Triada.fd, Triada.gs, Triada.gn and Triada.gm, hit the TOP 20 too.

Mamont banking Trojans, ranking fourth by number of attacked users, gained high popularity with cybercriminals. These malicious apps come in a multitude of variants. They typically target users’ funds via SMS or USSD requests. One of them spreads under the guise of a parcel tracking app for fake online stores.

Various malware files detected by machine learning technology ranked fifth (Trojan.AndroidOS.Boogr.gsh) and seventh (DangerousObject.AndroidOS.GenericML). They were followed by the Dwphon Trojan that came preinstalled on certain devices. The SpyNote RAT Trojans, which remained active throughout the year, occupied ninth, tenth and twentieth places.

Region-specific malware

This section describes malware types that mostly affected specific countries.

* Country where the malware was most active
* Share of unique users who encountered the malware in the indicated country as a percentage of all Kaspersky mobile security users attacked by the malware

Turkey and India accounted for the majority of region-specific threats in 2024. A variety of banking Trojans continued to be active in Turkey. Piom Trojans were associated with GodFather and BrowBot banker campaigns.

Users in India were attacked by Rewardsteal bankers and a variety of SmsThief SMS spies. Our quarterly reports have covered FakePay utilities widespread in Brazil and designed to defraud sellers by imitating payment transactions.

Mobile banking Trojans

The number of new banking Trojan installation packages dropped again to 68,730 as compared to the previous year.

The number of mobile banking Trojan installation packages detected by Kaspersky in 2021–2024 (download)

The total number of banker attacks increased dramatically over 2023’s level despite the drop in the number of unique installation packages. The trend has persisted for years. This may suggest that scammers began to scale down their efforts to generate unique applications, focusing instead on distributing the same files to a maximum number of victims.

TOP 10 mobile bankers

* Share of unique users who encountered this malware as a percentage of all users of Kaspersky mobile security solutions who encountered banking threats

Conclusion

The number of unique malware and unwanted software installation packages continued to decline year to year in 2024. However, the rate of that decline slowed down. The upward trend in mobile banking Trojan activity persisted despite the years-long decrease in unique installation packages.

Cybercriminals kept trying to sneak malware into official app stores like Google Play, but we also discovered a fair number of diverse preinstalled malicious apps in 2024. Speaking of interesting techniques first spotted last year, the use of NFC for stealing bank card data stands out.

securelist.com/mobile-threat-r…

Le forze di sicurezza serbe hanno sfruttato una serie di vulnerabilità zero-daydi Android sviluppate dall’azienda israeliana Cellebrite per sbloccare il telefono di uno studente attivista e tentare di installare uno spyware.

Cellebrite è specializzata in informatica forense e sviluppa strumenti per le forze dell’ordine, le agenzie di intelligence e le aziende private per estrarre dati dai dispositivi mobili. Tali aziende spesso utilizzano exploit Zero-day per aggirare la protezione dei telefoni bloccati.

In seguito alla pubblicazione da parte di Amnesty International di possibili violazioni dei diritti alla privacy in Serbia nel dicembre 2024, Cellebrite ha bloccato l’accesso ai suoi strumenti per i servizi speciali serbi. Tuttavia, non si sa esattamente quando le autorità abbiano avuto accesso alla vulnerabilità e l’abbiano sfruttata.

Google ha confermato tre vulnerabilità nei driver USB Linux utilizzati in Android che sono stati coinvolti nell’attacco:

• CVE-2024-53104 (punteggio CVSS: 7,8) (exploit della classe video USB);
• CVE-2024-53197 (punteggio CVSS: 5,5) (exploit del driver audio USB ALSA);
• CVE-2024-50302 (Punteggio CVSS: 5,5) (Exploit del dispositivo USB HID).

Il primo bug ha ricevuto una correzione in un aggiornamento di sicurezza di febbraio 2025, classificato come “a sfruttamento limitato”. Gli altri due non sono ancora inclusi nelle patch ufficiali. La correzione dei bug può richiedere tempo, soprattutto per i dispositivi che raramente ricevono aggiornamenti del kernel.

Presso l’Amnesty Security Lab è stato dichiarato che correggere CVE-2024-53104 potrebbe interrompere l’intera catena di sfruttamento, ma non vi è ancora la certezza assoluta al riguardo. A loro volta, gli sviluppatori di GrapheneOS notato che la loro versione di Android contiene già le correzioni per le due vulnerabilità rimanenti.

Google ha rilasciato le correzioni ai partner OEM il 18 gennaio. Tutte le vulnerabilità saranno incluse nei futuri bollettini sulla sicurezza di Android e diventeranno obbligatorie.

Le vulnerabilità USB vengono spesso sfruttate per aggirare la sicurezza del dispositivo, consentendo l’esecuzione di codice arbitrario, comandi dannosi o aggirando la schermata di blocco. Tuttavia, lo sfruttamento presuppone l’accesso fisico allo smartphone: in questo caso, ciò è stato possibile arrestando il proprietario del dispositivo da parte della polizia. A differenza di Apple, Android di serie non ha una modalità USB con restrizioni simili, ma gli utenti possono ridurre al minimo i rischi disattivando il debug USB nelle impostazioni e abilitando la funzione di crittografia dei dati.

L'articolo Google Conferma: Tre Gravi Bug Android Usati per Spiare Giornalisti e Attivisti! proviene da il blog della sicurezza informatica.

What do you do when you need to choose an OS at boot but aren’t physically near your machine? [Dakhnod]’s inventive solution is a mix of GRUB, Wake-on-LAN (WOL), and a lightweight ESP8266 running a simple HTTP server. In the past, [dakhnod] already enlightened us with another smart ESP hack. This one’s a clever combination of network booting and remote control that opens up possibilities beyond the usual dual-boot selector.

At its core, the hack modifies GRUB to fetch its boot configuration over HTTP. The ESP8266 (or any low-power device) serves up a config file defining which OS should launch. The trick lies in adding a custom script that tells GRUB to source an external config:
#!/usr/bin/env cat
net_dhcp
source (http,destination_ip_or_host:destination_port)/grub/config
Since GRUB itself makes the HTTP request, the system needs a running web server. That could be a Raspberry Pi, another machine, or the ESP itself. From there, a WOL-enabled ESP button can wake the PC and set the boot parameters remotely.

Is it secure? Well, that depends on your network. An open, unauthenticated web server dishing out GRUB configs is risky, but within a controlled LAN or a VLAN-segmented environment, it’s an intriguing option. Automation possibilities are everywhere — imagine remotely booting test rigs, toggling between OS environments for debugging, or even setting up kiosk machines that reconfigure themselves based on external triggers.

For those looking to take it further, using configfile instead of source allows for more dynamic menu entries, although it won’t persist environment variables. You could even combine it with this RasPi hack to control the uptime of the HTTP server. The balance between convenience and security is yours to strike.

If you’ve got your own wild GRUB customisation, let’s hear it!

hackaday.com/2025/03/03/wake-b…

Oggi sono rientrato da Malaga.

Malaga è Spagna, è Europa, e io amo l'Europa: unita, comune a tutti noi e - mi auguro - da ora in poi più forte.

Anche l'Italia è Europa, ma da qualsiasi Paese io provenga, ogni volta che ci ritorno, che ritorno a casa, ho un'impressione pessima del nostro Paese, che dura qualche ora, a volte un giorno o 2, perché ho ancora gli occhi dell'esploratore. Quelli del cittadino che vive qui ci mettono un po', a tornare.

Con quegli occhi vedo un Paese decadente, triste, che cade letteralmente in pezzi, mentre il resto dell'Europa va avanti.

E' vero, in alcuni Paesi europei sto meglio che in Italia, per i miei problemi di salute, ma non è solo questo. Parlo della qualità delle strade, dei trasporti, di cosa vedi quando ti guardi in giro: piste ciclabili, panorami urbani, lungomare, autostrade, aeroporti, eccetera.

Certo, ci sono anche ell'estero posti come quelli che ho appena descritto, ma ho la netta sensazione che nel nostro Paese tutti questi problemi siano...più densi, più presenti.

Se viaggiate spesso in Europa, vi chiedo: sono pazzo io o anche voi avete questa sensazione?

Un altro passo prima di chiudere definitivamente il mio account G💩gle: migrare tutti i (pochi) video del mio canale su #Peertube Uno Italia!

Tra questi, ecco la breve presentazione che ho realizzato qualche anno fa per l'Indirizzo Musicale dell'I.C. "Leonardo da Vinci", di #Ciampino dove insegno ormai da una decina d'anni.

Abbiamo ben 8 strumenti (caso unico nel Lazio e molto raro anche in tutta Italia!) e da noi la musica e le emozioni non mancano mai!

(indiscrezione... sto portando avanti la proposta di aprire il canale ufficiale della scuola su peertube.uno... 😉🤞)

P.S.: tutti i brani che sentite sono stati registrati dal vivo durante i concerti dei nostri ragazzi (tranne l'ultimo, montato in pandemia con le loro riprese inviate da casa).

Buona visione! 😊

L’Indirizzo Musicale dell’I.C. “Leonardo Da Vinci” di Ciampino

Otto strumenti, concerti, concorsi, gemellaggi... Tanti stili musicali, sfide, traguardi! Tutto questo ti aspetta alla "Leonardo Da Vinci" di Ciampino. Energia, passione, emozione... scoperta, cond...

^{PeerTube Uno Italia - Video Streaming italiano libero e federato}