Mobile malware infections in Russia jumped 70% in the first half of 2026 compared with the same period a year earlier, the Russian business daily Kommersant reported, citing MegaFon’s cyber threat monitoring system. The devices affected are primarily those running Android.
Among the leading threats is the Android banking trojan Mamont, which accounted for 10–12% of all detected infections last year and has climbed to 15% this year, experts said. Once installed, Mamont gains access to SMS notifications as well as payment and personal data.
The cybersecurity firm F6 said active campaigns using the trojan have been running since 2023. Approximately 1.5% of all Android devices in Russia — around 1.5 million — have been compromised by the virus.
Anton Basharin, managing director of AppSec Solutions, said the surge in criminal activity involving Mamont stems from the fact that, because apps are unavailable in official stores, installing APK files from third-party sources has become routine for Russian users.
“Users regularly install APK files from links in me’saging apps and search engines. Criminals exploit this by creating fake ‘banks’ or ‘app updates,’” he said. Growing interest in AI services, he added, has also become a factor — trojans are being distributed under the guise of such tools.
At Meduza, we are committed to transparency about our use of artificial intelligence in the newsroom. The story you’re reading was written by one of our living, breathing journalists and translated from Russian using an AI model configured to follow our strict editorial standards. This translation process is the result of extensive testing and refinements to ensure our English-language coverage is timely and accurate. A Meduza editor reviews every draft before publication.
If you find any errors in this translation, please contact us at [email protected].
To read Meduza’s exclusive content in English, please subscribe to our newsletter.
