Kaspersky Lab’s report on the evolution of threats targeting smartphones, tablets, and other mobile devices in 2012 was published in February 2013. Their data shows that in 2012 Android became the number-one target among virus writers, and that the number of threats over the course of the year grew steadily. Has this upswing in the number of mobile threats continued in 2013 so far? Indeed it has.

January is traditionally a quiet month for mobile virus writers — “only” 1,262 new modifications appeared in the first month of the year. But over the past few months, Kaspersky Lab has detected over 20,000 new mobile malware modifications. In February, they detected 12,044 mobile malware modifications, and another 9,443 in March. To compare — a total of 40,059 modifications of malicious programs targeting mobile devices were detected over the whole of 2012.

SMS Trojans, which send unauthorized text messages to short, premium-rate numbers, are still the most prevalent category of mobile threats and currently represent 63.6% of all attacks.

A total of 99.9% of new mobile threat detections target the Android platform.

According to KSN data, the Top 10 most commonly used malicious or potentially unwanted programs for Android are:

1 Trojan-SMS.AndroidOS.FakeInst.a - 29,45%
2 Trojan.AndroidOS.Plangton.a - 18,78%
3 Trojan-SMS.AndroidOS.Opfake.a - 12,23%
4 Trojan-SMS.AndroidOS.Opfake.bo - 11,49%
5 Trojan-SMS.AndroidOS.Agent.a - 3,43%
6 Trojan-SMS.AndroidOS.Agent.u - 2,54%
7 RiskTool.AndroidOS.AveaSMS.a - 1,79%
8 Monitor.AndroidOS.Walien.a - 1,60%
9 Trojan-SMS.AndroidOS.FakeInst.ei - 1,24%
10 Trojan-SMS.AndroidOS.Agent.aq - 1,10%

First place this past quarter goes to Trojan-SMS.AndroidOS.FakeInst.a (29.45%). This threat targets primarily Russian speaking Internet users attempting to download software for Android devices from dubious sites. Often, cybercriminals use these websites to spread malware under the guise of useful software.

(18.78%), an adware Trojan ranked second. This threat is seen primarily in European countries, where it is used by the developers of free software to monetize products by displaying ads.

Third and fourth place both went to SMS Trojans from the Opfake family: Trojan-SMS.AndroidOS.Opfake.a (12.23%) and Trojan-SMS.AndroidOS.Opfake.bo (11.49%). The first modifications of the Opfake family of threats were disguised as the latest version of Opera, a popular mobile browser. Today, the malicious programs in this family are disguised as new versions of other popular apps (Skype, Angry Birds, etc.).