Doctor Web’s Q4 2025 review of virus activity on mobile devices

Q4 2025 Doctor Web mobile threat roundup: ad-displaying trojans (Android.MobiDash, Android.HiddenAds) remained most widespread while banking trojan detections rose sharply; attackers distributed a dangerous backdoor (Android.Backdoor.Baohuo.1.origin) via unofficial Telegram X mods (≈58,000 infected devices) and abused modification services/tools (CloudInject, NPMod, LuckyPatcher) to inject dangerous permissions or bypass signature checks; multiple Android.Joker and Android.FakeApp samples were also found on Google Play — users are advised to use mobile anti-malware protections.