Doctor Web’s Q4 2025 virus activity review

Doctor Web's Q4 2025 telemetry report documents a 16.05% increase in detected threats driven mainly by adware, downloaders, malicious scripts, and trojans; rising Android banking-trojan activity and continued presence of ad-displaying mobile malware; increased user requests to decrypt files from encoder trojans; targeted activity by the Cavalry Werewolf APT; a Telegram-X-mod backdoor (Android.Backdoor.Baohuo.1.origin) that steals account credentials; the Trojan.ChimeraWire campaign that inflates web traffic via DLL search-order-hijack exploitation and anti-debugging techniques; plus ongoing phishing, fake marketplaces, and Google Play malicious-app distribution.