Doctor Web’s Q3 2026 review of virus activity on mobile devices

Doctor Web’s Q3 2026 mobile threats report details a surge in Android.Proxy trojans that convert infected devices into proxy exit nodes, continued activity from banking trojans (notably Android.Banker.Mamont) that intercept SMS and notifications, and dozens of Android.Joker samples found on Google Play which both subscribe users to paid services and—with new variants—join proxy botnets; the report includes detections, modification/obfuscation tool usage, and evidence of active botnet infrastructure and victim counts.