October 15, 2026 11 min read

Android Q3 2026 Malware Trend Report

Lathashree Karunagaran Lat61 Threat Intelligence Team

Executive summary

Banking trojans accounted for 56.4% of the Android malware samples analyzed by Point Wild in Q3 2026 (Jul–Sep). Several prominent campaigns relied on sideloaded APKs and abused Android Accessibility Services to steal credentials and gain remote control of infected devices.

AI enters the Android malware attack chain. RatHat uses a live generative-AI assistant during execution to help navigate infected devices, while RemControl contains evidence of AI-assisted development in its phishing overlays and command-and-control (C2) infrastructure.
Banking trojans became full RATs. Screen streaming, keylogging, remote taps, lock-pattern capture and anti-uninstall tricks are now standard.
NFC “ghost tapping” matured. The SpyNote RAT plus the new WindRelay relay turned victims’ physical cards into live ATM cash-outs.
Defenses get bypassed, not just evaded. Malware blinded Play Protect with a VPN and abused Wireless Debugging for shell access.
Google tightened sideloading. Developer verification went live in four countries on Sep 30; a zero-click Pixel modem flaw (CVE-2026-58704) was patched after in-the-wild exploitation.

Q3 detection profile

Q3 2026 at a glance

Metric	Q3 2026
Banking trojans’ share of Point Wild Android samples	56.4%
Top detected malware categories	Banking trojan, Adware, spyware
New banking trojans publicly disclosed	2 (RemControl, RatHat)
New NFC relay malware family	1 (WindRelay)
Banks targeted by RemControl alone	30+
Countries where developer verification went live	4 (Brazil, Indonesia, Singapore, Thailand)

AI-assisted Android malware: development and runtime navigation

Two new banking trojans disclosed in September 2026 illustrate different uses of AI in the Android malware attack chain. RatHat uses AI-assisted navigation during execution, while RemControl shows evidence of AI-assisted development. Both abuse Accessibility Services, and employ techniques designed to maintain control over infected devices.

Family	Targets	What’s new
RemControl	30+ banks in Italy, France, Spain, Poland, Portugal, Canada, Gulf states	RemControl is an Android banking trojan that combines Accessibility-based remote control, credential theft, Play Protect evasion and anti-detection techniques to enable fraudulent banking activity.
RatHat (a.k.a. RedHat)	Financial apps (overlay list); China-linked actors	RatHat combines AI-assisted screen navigation, Accessibility abuse and Wireless Debugging exploitation to gain shell-level device access. It targets financial credentials and OTPs, reconstructs device PINs and lock patterns, and uses persistence techniques that can allow it to return after the malicious app is removed.

Threat landscape by category

RATs, NFC relay and device takeover

The quarter’s other headline was attackers chaining a remote access trojan with NFC relay malware to cash out a victim’s physical card in real time.

SpyNote + WindRelay. A fake bank caller kept a victim on a 13-minute call while they installed the SpyNote RAT. SpyNote then quietly installed WindRelay, a new NFC relay family. The attackers took out a loan through the victim’s real banking app, then had the victim tap their card and enter the PIN; WindRelay relayed the card data live for purchases and ATM withdrawals.
“Ghost tapping” gets a new family. WindRelay joins NGate and SuperCard X as malware that relays a victim’s contactless card tap live to a criminal’s terminal; the Q3 case stands out for pairing the relay with a full remote-access trojan.
Full remote control is now standard. Both RemControl and RatHat stream the screen, log every tap and keystroke, allow remote swipes and typing, and capture lock-screen patterns, blurring the line between banking trojan and RAT.

SpyNote + WindRelay fraud chain · 6 steps across attacker and victim (Group-IB via Malwarebytes, Aug 2026)

The phone call is the control channel: it keeps the victim acting while the attacker works the banking app and the relay in parallel.

The sources reviewed disclosed no new state-linked Android spyware family in Jul–Sep 2026.

Adware and spyware

Adware and spyware were Point Wild’s second- and third-largest detection categories in Q3; public reporting shows both increasingly delivered through ads.

Ad-driven malware. StreamRat spread through malicious mobile ads and reached hundreds of thousands of users, while the Papyrus scheme automated fake ad clicks at scale.
Surveillance RATs. Zimperium disclosed the Glitch SPY RAT, the Octagon RAT and an Android surveillance operation running on more than 170 servers.

How infections start

The major campaigns reviewed in Q3 predominantly relied on sideloaded APKs followed by abuse of Accessibility Services.

Q3 2026 infection chain · 4 lures, 1 shared path

Blocking the sideload or the permission grant breaks every chain shown;

Lure	Seen in	How it works
Fake Play Store pages + paid social ads	RemControl	Pages impersonating the TVTap IPTV app, pushed with Meta ads and geo-fenced to Italian IPs; IPTV apps work as bait because users already expect to install them off-store
Smishing and malvertising	RatHat	SMS links and ads lead to download pages posing as a streaming app or Chrome; a fake “network restriction” or cash incentive pushes the Accessibility grant
Phone call from a fake bank (vishing)	SpyNote + WindRelay	A live caller talks the victim through installing a “bank” app, tapping their card and typing the PIN
Fake system update screen	RemControl dropper	The dropper shows a bogus update, asks for VPN permission and uses it to cut off Play Protect scanning

Q3 2026 vs Q2

Q3 brought new banking trojans that use AI and full remote control, and shifted delivery from loaders hidden on Google Play to sideloaded apps; Mamont banking trojans and Google Play loaders led Q2’s activity.

Theme	Q2 2026 (Apr–Jun)	Q3 2026 (Jul–Sep)
New Android families	No major new banking family; Mamont variants led banking-trojan detections	RemControl and RatHat (banking trojans), WindRelay (NFC relay)
Main Android vector	Loaders on Google Play, such as a fake PDF reader dropping the Anatsa trojan	Sideloaded APKs from fake Play Store pages, scam texts and fake bank calls
AI in malware	PromptSpy, first observed in Q1 2026, continued to be relevant in Q2 2026 for its use of generative AI during malware execution.	RatHat uses AI to navigate phones live; RemControl was built with AI help
Card fraud	No new NFC relay family reported	SpyNote + WindRelay relayed tapped cards live to criminals at ATMs
Exploited flaws	No exploited Android zero-click flaw reported	Pixel modem flaw CVE-2026-58704 exploited in the wild
Platform defences	Developer verification registration open; no enforcement yet	Verification enforced in Brazil, Indonesia, Singapore and Thailand from Sep 30

Industry impact

Q3’s Android malware hit banking and fintech almost exclusively; other industries show up through phishing and ad fraud rather than malware.

Industry	Q3 2026 evidence
Banking and fintech	RemControl and RatHat, Zimperium identified 34 malware families with targeting capabilities against 1,243 banking and fintech apps across 90 countries.
Crypto and payments	The Rokarolla banker targets 217 banking and crypto apps; WindRelay cashes out contactless cards at ATMs and terminals; Indian payloads overlay UPI apps
Enterprise	Device-code phishing increased, Vishing attacks doubled, with threat actors increasingly targeting users and help desks to compromise cloud identities.
Advertising and media	StreamRat spread through malicious mobile ads to hundreds of thousands of users; the Papyrus scheme automated fake ad clicks

Platform and defensive developments

Google’s biggest Q3 move was switching on developer verification for sideloaded apps. Developer verification began regional enforcement on September 30, 2026, in Brazil, Indonesia, Singapore and Thailand for participating app stores. Direct APK sideloading remains possible through advanced-flow/ADB mechanisms in this initial phase, with broader enforcement planned for 2027. India is outside the initial four-country rollout.

Myth vs fact

Q3’s campaigns broke several common assumptions about Android safety.

Myth	Fact	Q3 evidence
“Play Protect or antivirus will catch it.”	Q3 malware switched protection off or changed shape per device.	RemControl used a VPN to stop Play Protect scanning and re-signed itself on each phone to defeat hash detection; RatHat’s AI-chosen taps vary, which makes signature rules less effective.
“Uninstalling the app removes it.”	Some Q3 malware blocks removal or comes back.	RemControl closes the settings screens used to uninstall or reset; RatHat reinstalls itself and needs a factory reset.
“One-time passwords keep my bank account safe.”	Overlays capture OTPs and PINs as you type them.	RemControl and RatHat both steal OTPs; RatHat rebuilds PINs and unlock patterns from raw touch positions.
“My card is safe if it never leaves my wallet.”	A card tapped on an infected phone can be used elsewhere in real time.	WindRelay relayed victims’ card taps live to criminals at ATMs and payment terminals.
“My bank might ask me to install an app to protect my account.”	Banks don’t send apps by call or link.	The SpyNote + WindRelay victim installed a “bank” app during a 13-minute fake bank call.
“If I don’t tap anything, my phone can’t be hacked.”	Zero-click flaws need no user action.	Pixel modem flaw CVE-2026-58704 was exploited in the wild before the September patch.
“Apps on Google Play are always safe.”	The store is safer, not clean.	Zimperium reported deceptive apps abusing Google Play’s Early Access program on Sep 25.

What to look for in Q4 2026

Q4 is likely to bring wider use of Q3’s new banking trojans, more NFC card relay, and seasonal lure waves; the chart below maps when each threat is expected to peak. These are forecasts based on Q3 activity, not observed events.

Q4 2026 malware watch · forecast windows based on Q3 activity; bulletin dates assume Google’s usual first-Monday schedule;

Zero-click exploit patches (Oct 5, Nov 2, Dec 7). After September’s exploited modem flaw, each monthly bulletin is the point to check for new in-the-wild Android exploits.
Seasonal APK droppers (highlighted). Expect festive greeting, offer, and bill-payment APKs in India through October and November, then delivery and shopping-themed droppers in Western markets from Nov 27. Both feed the same sideload-then-permissions chain, with banking trojans and RATs as the likely payloads.
Banking trojans. RemControl and RatHat are sold as malware-as-a-service, so affiliates can add new countries and banks at any time, possibly including Indian banks.
NFC relay malware. Expect new relay families and more pairing with remote-access trojans such as SpyNote; holiday contactless spending gives relay fraud more cover.

Two items sit outside the chart: installers that coach victims around developer verification in Brazil, Indonesia, Singapore and Thailand, and Point Wild’s Q4 detection split, which will show whether banking trojans keep Q3’s 56.4% lead.

Recommendations

For consumers

Install apps only from Google Play or your phone maker’s store, never from links sent over WhatsApp, Telegram, SMS, or a phone call.
Refuse any app that asks for Accessibility, Developer Options, or Wireless Debugging unless it is an accessibility tool you chose yourself.
No bank asks you to install an app or tap your card on your phone; hang up and call the number on your card.
Keep your phone updated; on Pixel, security patch level 2026-09-05 or later.
If infected, factory reset from a clean state, then change banking and UPI credentials from another device.

For enterprises

Block or warn on APK installs from browsers, messaging apps and SMS links on managed devices.
Treat any non-accessibility app requesting Accessibility, Developer Options or Wireless Debugging as malicious; enable Advanced Protection Mode on high-risk devices.
Enforce minimum patch levels (Pixel 2026-09-05 or later) and track OEM bulletins for other brands.
Train staff to spot bank and IT help-desk impersonation calls.

For banks and fintech

Flag sessions showing remote-control signals (screen streaming, injected taps) combined with new-device loans, the cash-out pattern in the SpyNote + WindRelay case.
Detects overlays, Accessibility abuse, and screen mirroring inside the banking app before allowing high-risk transactions.
Monitors for brand impersonation: fake app-store pages and download sites using your name or logo.

References

Keep reading

Malware Analysis Report