Mobile Malware · Malware Basics · Lesson 2 of 5

Malware Types

Banking trojans, spyware, adware, lockers and droppers, sorted by what they do.

Trojans that want your bank, and apps that watch you

Analysts usually sort malware by its goal, not by how it looks. The disguise changes every month. The goal rarely does.

Banking trojans are the most studied mobile threat. Their goal is your banking logins, your one-time codes and, in the end, your money. You saw in Android App Security how they draw fake login screens over real bank apps. The piece that makes modern ones so dangerous is the accessibility service. Once a user turns it on, the trojan can read what's on screen and tap buttons, so it can grab a code from a text message or even approve a transfer while the victim watches a fake loading screen. Families such as Anatsa and Octo, documented by ThreatFabric, follow this pattern.

Spyware has a different goal: collecting information. Google defines it as code that collects, exfiltrates or shares user or device data unrelated to the app's legitimate job. It ranges from shady apps that upload your contacts, all the way up to mercenary tools sold to governments.

Stalkerware is spyware installed by someone the victim knows, often a partner, to monitor messages and location. You covered the warning signs and the safe way to respond in Android App Security. For analysts it's a special case, because removing it can alert the person who installed it.

All three lean on the same Android features: accessibility, notification access, SMS and overlays. That's why Android has tightened them. On Android 13 and later, a sideloaded app can't simply switch on accessibility. The setting is restricted until the user overrides it on purpose.

On the simulated phone, try to enable Battery Booster Pro, which was installed from a website. Follow each screen Android shows you, then open the bank app and note what the service can observe.

Adware, fraud, lockers and droppers

The rest of the common types, sorted by goal:

• Adware shows ads aggressively: full screen pop-ups, ads on the lock screen, icons that hide so you can't find the app to remove it. It's often grayware rather than outright malware, but it's very common.
• Ad fraud is sneakier. The app loads ads you never see and fakes taps on them, so the attacker gets paid by advertisers. Google started counting click fraud as a PHA category in 2018, and that year it made up over half of PHA installs from Google Play. Google noted it mostly harms ad networks rather than users, though it still drains battery and data.
• Billing fraud charges you deceptively. SMS fraud sends texts to premium numbers, and toll fraud signs you up for subscriptions billed to your phone account. Bread (Joker), from Android App Security, is the classic family.
• Ransomware takes control of the device or its data and demands payment. Most early Android ransomware were screen lockers that covered the display with a fake police warning. In 2014, ESET described Simplocker as the first Android ransomware that actually encrypted files on the SD card.
• Droppers (Google's hostile downloaders) carry no harmful payload themselves. Their job is to get installed, look clean, and later fetch the real malware, often a banking trojan.

Real samples mix these. A dropper installs a banking trojan that also shows ads and reads texts. Analysts usually name a sample by its most harmful behavior, and list the rest as capabilities.

A helpful habit: when you read about a new threat, ask "what is it trying to get?" The answer usually tells you how serious it is and how to stop it.