|
Android Mobile Adware Surges in Second Half of 2025
Thursday, January 22, 2026
Malwarebytes threat research reveals spike in adware and malicious malware families Triada and MobiDash heading into the holiday season
SANTA CLARA, Calif., Dec. 17, 2025 /PRNewswire/ -- Malwarebytes, a global leader in online protection, shared new research showcasing a dramatic uptick in threats targeting Android users as the mobile channel becomes a prime vector for financial scams and aggressive adware campaigns. With people now 39% more likely to click links on their phones than laptops, cybercriminals continue to exploit this shift in consumer habits, especially during the commerce heavy holiday season.
Read the research: www.malwarebytes.com/blog/mobile/2025/12/android-threats-in-2025-when-your-phone-becomes-the-main-attack-surface
"The holiday season may have just kicked off, but cybercriminals have been laying the groundwork for months for successful Android malware campaigns," said Shahak Shalev, Global Head of Scam and AI Research, Malwarebytes. "In the second half of 2025, we observed a clear escalation in mobile threats. Adware volumes nearly doubled, driven by aggressive families like MobiDash, while PUPs surged , suggesting attackers are experimenting with new delivery mechanisms. I urge everyone to stay vigilant over the holidays and not be tempted to click on sponsored ads, pop-ups or shop via social media. If an offer is too good to be true, it usually is."
Key research findings
-- Adware spikes: Adware, a malicious software that displays
advertisements, pop-ups, banners and in-browser ads that often deliver
malware, has been ramping up toward the end of the year with adware
levels nearly doubled from the December to May period to the June to
November timeframe, with a persistent upward trend from August through
November (27% increase). This is not surprising given the holiday
shopping season and the volume of sales that flows through mobile
devices.
-- MobiDash comes to life in the second half of the year: A particularly
aggressive adware, MobiDash, has been increasing since June with a 77%
jump in detections from September through November. MobiDash waits
roughly three days after being installed to display ads, making it
harder to trace as the root cause for many Android users.
-- Resurgence of Triada Trojan: Malwarebytes tracked a resurgence of the
remote access trojan (RAT) Triada in October and November. Triada is
used to compromise Android devices to steal confidential and sensitive
information such as credit card numbers, passwords and bank account
information. It also provides a backdoor for attackers into the device
with a special focus on banking and communication applications. This
threat often comes pre-installed on aftermarket or refurbished Android
phones, ringing the alarm bells for any holiday deals related to Android
devices.
-- Potentially Unwanted Programs (PUPs) on the rise: PUP detections
increased by nearly 75% in the June to November period compared to
December to May. The second half brought a sharp escalation, especially
from August onward. While PUPs can be harmless, the trend could reveal
criminals are testing new packages or campaigns for delivering malware.
Malwarebytes Mobile Security updates
As mobile threats surge, Malwarebytes has made big investments in its mobile security solution to stay ahead of new threats and scams targeting mobile users. Highlights include new product features and enhancements, and additional validation from leading independent testers.
-- Seven times certified by MRG Effitas Android 360° test: MRG Effitas, a
globally recognized security assessment firm, awarded Malwarebytes
Mobile Security its Android 360° Certification for the seventh time in
a row. The rigorous certification tests a variety of real-life scenarios
and in-the-wild pieces of malware, like SMS payments, banking trojans,
and spyware, alongside benign samples to test for false positives.
-- Scam Guard: Malwarebytes launched Scam Guard, its AI-powered scam
detector that has helped millions spot and report scams. Recent updates
include a streamlined submission process for users, including a new
welcome screen and media picker.
-- Advanced Text Filtering: Recent updates to the text filtering feature
more than quadrupled efficacy for keeping scams and junk out of a user's
inbox. The Android solution now denotes URL shorteners for more advanced
scanning and identification of malicious links. Additionally, text
message content may now be flagged for suspicious concepts, such as
romance themes or money requests, providing an additional layer of
detection and protection.
-- Expanded Safe Browsing: Safe Browsing feature now supports Brave,
DuckDuckGo, Edge and more--protecting users wherever they connect.
To learn more about Malwarebytes Mobile Security, download the mobile app today.
About Malwarebytes
Malwarebytes is reimagining security to safeguard devices, data and people, no matter their location, lifestyle or means. A global leader in online protection, its suite of award-winning cybersecurity, privacy and identity solutions empower millions of people worldwide to enjoy their digital lives, free from threats and scams. Built and beloved by experts, Malwarebytes pairs a world-class team of threat researchers with proprietary AI-powered processes to supercharge and refine detections, providing unmatched protection against both known and unknown threats. Living up to its legacy, Malwarebytes continues to offer free tools that have long served as a first line of defense against malware and scams with new options for identity protection and data removal.
Malwarebytes, powerful digital protection that's always by your side.
Learn more: https://www.malwarebytes.com.
Malwarebytes Media Contact:
Ashley Stewart
Director of Public and Analyst Relations
press@malwarebytes.com
View original content to download multimedia:https://www.prnewswire.com/news-releases/android-mobile-adware-surges-in-second-half-of-2025-302644115.html
SOURCE Malwarebytes
|
|
|
|
|
|
 |
Identiv Completes Thailand Manufacturing Transition, Unlocking Next-Generation Multicomponent Manufacturing for Advanced IoT Solutions | Jan 22, 2026
|
|
Global Cyber Alliance Identifies Five Cybersecurity Forces That Defined 2025 - And Will Shape 2026 | Jan 22, 2026
|
|
pgEdge Announces pgEdge Agentic AI Toolkit for Postgres | Jan 22, 2026
|
|
New Report Names States Most Vulnerable to Holiday Scams | Jan 22, 2026
|
|
Guardz 2025 SMB Cybersecurity Report: Nearly 50% of U.S. Small Businesses Have Been Hit by Cyber Attack | Jan 22, 2026
|
|
LG ELECTRONICS INTRODUCES 2026 LG GRAM LINEUP ELEVATED BY AEROMINUM | Jan 22, 2026
|
|
Truvista Fiber Acquires SlyTel | Jan 22, 2026
|
|
Breakthrough Progress: METiS TechBio Publishes Consecutive Research Findings in Nature Communications and the Journal for ImmunoTherapy of Cancer | Jan 22, 2026
|
|
Healthcare Industry Executives are Likely to be Personal Targets of Cybercrime | Jan 22, 2026
|
|
Indusface Introduces AppTrana AI Shield to Help Organizations Safely Scale GenAI Across the Business | Dec 12, 2025
|
|
|
|
