IT threat evolution in Q3 2026. Mobile statistics

In Q3 2026, mobile threats continued to evolve with notable attacks leveraging AI for fraud automation and image analysis. A malicious app disguised as Google Play Protect used DistilBERT to interpret C2 commands, potentially powered by LLM-generated input. Another Trojan analyzed device gallery images and screenshots using on-device AI to extract banking data like CVV codes. iOS users were targeted via malicious PHP packages in Packagist and a fake crypto tracker app, FomoPeek, in the App Store, both delivering the DarkSword exploit kit to steal keychain data, Wi-Fi passwords, SMS, photos, and crypto wallet seeds. Additional iOS attacks involved infected apps distributed via Telegram that required users to purchase developer certificates, enabling data exfiltration including screenshots and device information.

AI-extracted · verify before operational use