By 
The short version
- Yes, Android phones get infected. Mostly banking trojans and adware, mostly via sideloads and texts.
- The Play Store is defended, not safe. Google blocked 1.75 million apps in 2025, and some slipped through.
- Your risk is your habits and patch level, not your brand.
- Reported payment-fraud losses fell 51% in 2025. NIBSS's count, not every thief's ledger.
2 a.m., and your my phone glows again. The pop-up says "Viruses Detected!!! Tap to Remove." By breakfast, everyone in the family is an immunologist. Nobody can find a single one.
I have been round this twice: the panic, the pop-up, the cleaner app the pop-up wanted me to install. Both times the honest answer was the boring one. I test on my phone running HiOS on Android 15. No malware was staged on it. Every figure carries its named source and a date. Whatever could not be re-verified says so.
Your uncle will tap the pop-up anyway. Do not tap it.
The numbers, dated: what the labs counted
Fear sells cleaner apps. The counts below are the labs' own.
| Metric | Value | Source and quarter |
|---|---|---|
| Mobile attacks blocked | 1.67 million | Securelist Q3 2026 (12 Nov 2026) |
| Banker share of Q3 2026 detections | 31.63% | Securelist Q3 2026 (12 Nov 2026) |
| New malicious packages (Q3 2026) | 378,456 (119,688 banker) | Securelist Q3 2026 (12 Nov 2026) |
| Ransomware packages | 570 | Securelist Q2 2026 (12 Nov 2026) |
| Spike in banker-driven mobile threats | Fourfold | BusinessDay, 17 Sep 2025 (30 Sep 2026) |
| Apps blocked from Play in 2025 | 1.75 million; 80,000 accounts banned | Google, 19 Feb 2026 (30 Sep 2026) |
| Adware surge in 2025 | Up 90% | Malwarebytes, 16 Dec 2025 (30 Sep 2026) |
| Phones on Android 12 or older | About 1 billion devices; 42.1% | Moneycontrol, 8 Feb 2026 (12 Nov 2026) |
Securelist's Q3 2026 report, published 10 November 2026 by Anton Kivva, read 12 November 2026, is the lab record behind the rows. It counted 1,668,368 attacks, down from Q2's 1,996,823. The 1.67 million is attacks blocked, not infections confirmed.
The same lab's Q1 2026 record, published 18 May 2026, counted 2.67 million attacks: bankers at 52.96%, 306,000 fresh packages, 162,275 of them bankers. 439 ransomware packages came with it.
Google's 2025 Play defence review, published 19 February 2026, carries the 1.75 million and the 80,000 accounts: the defender's half, kept beside the attacker's.
How it gets in: sideloads, texts, store slips
Three doors, and two of them are yours to close.
| Route | What the numbers say | Source |
|---|---|---|
| Sideloaded APKs | 3% of apps analyzed from outside Play contain malware (0.03% on Play) | Lookout, Mar 2026 (12 Nov 2026) |
| Sideloads, composition | Riskware and trojans account for 80% of the malware observed in sideloaded apps | Zimperium, Nov 2024 (12 Nov 2026) |
| Text links (smishing) | OTP theft at scale | Malwarebytes, 16 Dec 2025 (30 Sep 2026) |
| Play Store slips | 1.75 million blocked, yet 239 apps with about 42 million installs slipped through | Google, 19 February 2026; gHacks via vervali, second-hand |
Lookout calls the 3% persuasion, not exploit: the door is not forced, someone talks you into it. Their 2024 numbers put phishing exposure at 26% on iOS and 12% on Android.
That 50-times line still circulates as the Android-versus-iPhone answer. It recycles 2010s-era reports, with no date and no denominator. I would not repeat it to anyone.
Malwarebytes' 2025 threats review, published 16 December 2025, documents OTP theft at scale. One-time-password interception turns a leaked credential into a drained account.
The cast: bankers, adware, spyware, ransomware, stalkerware
Virus versus malware is a wording fight, and the wording loses. A true virus copies itself. Nearly everything on Android is a trojan, adware or spyware that needs you to open it first.
Banking trojans lead the counts: over half of Q1 2026 detections, with banker-driven threats up fourfold (BusinessDay, 17 September 2025). Mamont is the name to know.
Adware jumped 90% in 2025 (Malwarebytes, 16 December 2025). It is the least dramatic cast member: ads you did not ask for, metered against your data bundle.
439 new ransomware packages landed in Q1 2026 (Securelist, 18 May 2026). DroidLock is the name to watch (Zimperium, 10 December 2025).
Stalkerware is the human-harm end. EFF and AV-Comparatives' 2025 test, published 6 November 2025, checked 17 stalkerware products. Play Protect detected 53%; Trend Micro managed 59%; Malwarebytes detected all 17. The tell is permissions: accessibility and notification access.
iPhone versus Android, honestly
Android leads raw malware volume: global share and an open install path. iPhones are not clean either.
The 50-times multiple still circulates as the iPhone-versus-Android answer. The figure recycles 2010s-era reporting, with no denominator and no date worth printing.
Malwarebytes' July 2025 analysis found iPhone owners more reckless and less protected online (12 November 2026). Habits travel with the owner.
Nigeria: bankers, texts, loan apps, old phones
The honest loss curve from the NIBSS record: ₦17.67bn in 2023, internet-banking fraud up 325% that year (2023 report, April 2024).
Losses rose to ₦52.26bn in 2024, driven by one ₦31.1bn incident. They fell to ₦25.85bn in 2025, down 51%, with Lagos at 63.43% of fraud activity (NIBSS, 22 January 2026, read 12 November 2026).
Read the fall correctly: a trend, not a solved problem. E-commerce and internet banking stay the most affected channels. Social engineering stays the commonest technique, from the same update.
Ranked by likelihood:
- Smishing and OTP theft: scam texts pushing fake bank or wallet links. NDIC warns about these (30 September 2026).
- Fake banker apps sideloaded from texts or ads, including fake VPN-client lures (BusinessDay, 17 September 2025).
- Loan apps that harvest your contacts as leverage after a missed payment.
- Unpatched old phones, sitting on the wrong side of the update line.
FIJ documented the route: numbers bought from leaks and loan-app contact lists (30 September 2026). Treat every fraud text as hostile.
If a text asks for an OTP, the bank is not asking. Banks never ask for OTPs by text.
Old phones: the billion-device question
Moneycontrol's report, 8 February 2026, read 12 November 2026, puts about a billion phones on Android 12 or older. 42.1% of Android phones get no patches.
Old does not mean doomed. Update everything it still accepts. Bank in the app or the browser, never a texted link. Plan the replacement before banking apps stop supporting it.
What actually protects you
Habits, not products:
- Play Store only. Every APK link in a text is hostile.
- Updates, fast. Turn on auto-update and let it run overnight on Wi-Fi.
- Permissions, monthly. Accessibility and notification access are the two stalkerware needs. Settings search: "accessibility".
- The smishing pause. Ten seconds before any link. Banks do not text for OTPs.
- Source matters. An APK from the developer's site beats a mirror, because a mirror adds tampering to a risky file.
The antivirus decision page is researched and not yet live. If your phone already acts strange, our guide to stopping malware from destroying your phone covers removal. Fake-VPN lures stitch this arc to the privacy guides: a VPN is a tunnel, not a shield.
What I tested on my phone, and what I could not verify
HiOS shows the patch level under a Settings search for "security update". Play Protect scans run from the Play Store. HiOS shuffles its labels between builds, so search by keyword, not by menu path.
I shot no screen for this. HiOS varies by build, and an invented path would bounce you off the page.
Lab figures are cited from the labs at the dates printed beside them. No rate was re-measured on this my phone, and no malware was staged on it. No device session happened here; that is the honest limit of this page.
Securelist figures cross a Q3 2025 recount. Any year-over-year chart drawn from them, ours included, keeps the caveat.
Questions readers ask
Is a virus the same thing as malware?
No. A virus copies itself. Nearly everything on Android needs you to open it: trojans, adware, spyware.
Is Android really 50 times riskier than iPhone?
That 50-times line recycles 2010s-era reports with no denominator and no date you can print. The dated split: bankers at 52.96% of Q1 2026 detections; phishing 26% on iOS versus 12% on Android (Lookout 2024).
Is the Play Store safe, then?
Safer, not safe. Google blocked 1.75 million apps in 2025. Some 239 apps with about 42 million installs slipped through, a second-hand figure (gHacks via vervali).
Is an APK from the developer's own site risky?
Less than a mirror site, never zero. The store screens; the developer site serves the file raw. Outside Play, you are the screener.
My phone is old and gets no updates. How bad is it?
About 42.1% of Android phones sit on version 12 or older, about a billion devices (Moneycontrol, 8 February 2026, read 12 November 2026). Bank in the app; plan the replacement.
NIBSS says fraud losses fell 51%. Is fraud solved?
No. One ₦31.1bn incident drove the 2024 peak. 2025 fell to ₦25.85bn, down 51%, and the technique did not change (NIBSS, 22 January 2026).
The order that protects you: Play Store, patches, permissions, the ten-second pause. Already tapped the thing? The removal guide is next; the Android problems hub carries the rest.
Comments
New posts held for reviewCouldn't load comments - the thread service didn't answer. Nothing is being hidden: no approved comments are saved with this page.
No approved comments yet - the first one is yours. New posts are held for review before they appear.