Q4 2025 Malware Trends: Telegram Backdoor, Banking Trojans Surge, Joker Returns to Google Play

Doctor Web's Q4 2025 mobile malware review reports a widespread backdoor (Android.Backdoor.Baohuo.1.origin) hidden in unofficial Telegram X builds that infected roughly 58,000 Android devices — including phones, tablets, TVs and in-car systems — and allows attackers persistent, stealthy control of Telegram accounts. The report also highlights a >65% rise in Android banking trojans and the return of Joker and FakeApp variants on Google Play, emphasizing distribution via third-party stores and suspicious sites.