MegaFon monitoring has revealed a sharp 34% year-over-year increase in the number of Russian users whose smartphones were found to contain mobile malware during the summer of 2026.
The most significant surge occurred in August, when detections rose by 77% compared with the same month last year. The primary threat consists of Android trojans that can silently install applications, intercept notifications, provide remote access to attackers, and exfiltrate personal data.
While mobile malware activity grew, the number of blocked suspicious calls declined markedly: 31% fewer in June, 41% fewer in July, and 75% fewer in August year over year. In September the figure remained 73% below the previous year’s level. MegaFon attributes this drop to coordinated government and corporate efforts against telephone fraud.
However, the reduction in blocked calls does not indicate that scammers have ceased operations. Attackers are increasingly relying on compromised messenger accounts obtained through social engineering, malware deployment, and even offers to rent out user credentials.
According to Sergey Khrenov, Director of the relevant department at MegaFon, hybrid attacks are becoming common: during a fraudulent call, victims are persuaded to install what appears to be a legitimate application, which in reality is spyware that allows attackers to monitor the target and adjust their tactics in real time.
Phishing activity also remains high. Among identified malicious resources, 30% are linked to investments and cryptocurrencies, 21% to social networks and messengers, and 9% to potentially harmful APK files. These categories frequently overlap, turning the victim’s own smartphone into an instrument for further fraud.
