December 17, 2025

Android Mobile Adware Surges in Second Half of 2025 

Malwarebytes threat research reveals spike in adware and malicious malware families Triada and MobiDash heading into the holiday season 

SANTA CLARA, Calif. – December 17, 2025 – Malwarebytes, a global leader in online protection, shared new research showcasing a dramatic uptick in threats targeting Android users as the mobile channel becomes a prime vector for financial scams and aggressive adware campaigns. With people now 39% more likely to click links on their phones than laptops, cybercriminals continue to exploit this shift in consumer habits, especially during the commerce heavy holiday season.  

Read the research: www.malwarebytes.com/blog/mobile/2025/12/android-threats-in-2025-when-your-phone-becomes-the-main-attack-surface 

“The holiday season may have just kicked off, but cybercriminals have been laying the groundwork for months for successful Android malware campaigns,” said Shahak Shalev, Global Head of Scam and AI Research, Malwarebytes. “In the second half of 2025, we observed a clear escalation in mobile threats. Adware volumes nearly doubled, driven by aggressive families like MobiDash, while PUPs surged, suggesting attackers are experimenting with new delivery mechanisms. I urge everyone to stay vigilant over the holidays and not be tempted to click on sponsored ads, pop-ups or shop via social media. If an offer is too good to be true, it usually is.” 

Key research findings 

  • Adware spikes: Adware, a malicious software that displays advertisements, pop-ups, banners and in-browser ads that often deliver malware, has been ramping up toward the end of the year with adware levels nearly doubled from the December to May period to the June to November timeframe, with a persistent upward trend from August through November (27% increase). This is not surprising given the holiday shopping season and the volume of sales that flows through mobile devices. 
  • MobiDash comes to life in the second half of the year: A particularly aggressive adware, MobiDash, has been increasing since June with a 77% jump in detections from September through November. MobiDash waits roughly three days after being installed to display ads, making it harder to trace as the root cause for many Android users.  
  • Resurgence of Triada Trojan: Malwarebytes tracked a resurgence of the remote access trojan (RAT) Triada in October and November. Triada is used to compromise Android devices to steal confidential and sensitive information such as credit card numbers, passwords and bank account information. It also provides a backdoor for attackers into the device with a special focus on banking and communication applications. This threat often comes pre-installed on aftermarket or refurbished Android phones, ringing the alarm bells for any holiday deals related to Android devices.   
  • Potentially Unwanted Programs (PUPs) on the rise: PUP detections increased by nearly 75% in the June to November period compared to December to May. The second half brought a sharp escalation, especially from August onward. While PUPs can be harmless, the trend could reveal criminals are testing new packages or campaigns for delivering malware.  

Malwarebytes Mobile Security updates 

As mobile threats surge, Malwarebytes has made big investments in its mobile security solution to stay ahead of new threats and scams targeting mobile users. Highlights include new product features and enhancements, and additional validation from leading independent testers.   

  • Seven times certified by MRG Effitas Android 360° test: MRG Effitas, a globally recognized security assessment firm, awarded Malwarebytes Mobile Security its Android 360° Certification for the seventh time in a row. The rigorous certification tests a variety of real-life scenarios and in-the-wild pieces of malware, like SMS payments, banking trojans, and spyware, alongside benign samples to test for false positives.  
  • Scam Guard: Malwarebytes launched Scam Guard, its AI-powered scam detector that has helped millions spot and report scams. Recent updates include a streamlined submission process for users, including a new welcome screen and media picker. 
  • Advanced Text Filtering: Recent updates to the text filtering feature more than quadrupled efficacy for keeping scams and junk out of a user’s inbox. The Android solution now denotes URL shorteners for more advanced scanning and identification of malicious links. Additionally, text message content may now be flagged for suspicious concepts, such as romance themes or money requests, providing an additional layer of detection and protection.  
  • Expanded Safe Browsing: Safe Browsing feature now supports Brave, DuckDuckGo, Edge and more—protecting users wherever they connect. 

To learn more about Malwarebytes Mobile Security, download the mobile app today.