Doctor Web’s Q2 2025 review of virus activity on mobile devices

Q2 2025 Android threat summary: adware families (Android.HiddenAds, Android.MobiDash) remained most common while banking trojans increased; researchers uncovered Android.Clipper.31 implanted in device firmware and a modified WhatsApp that replaces crypto wallet addresses and exfiltrates images to steal funds, and identified Android.Spy.1292.origin distributed to target Russian military personnel. Several fake financial and gaming apps and adware were also found on Google Play, indicating broad distribution and active exploitation.