Q4 2025 Malware Trends: Telegram Backdoor, Banking Trojans Surge, Joker Returns to Google Play

Why It Matters

The compromise of a popular messaging platform gives threat actors persistent control over user communications and financial credentials, amplifying fraud risk. Enterprises and consumers must reassess app sourcing policies to mitigate widespread credential theft and financial loss.

Key Takeaways

• Telegram X backdoor infected ~58k Android devices.
• Attack spreads via unofficial app stores and websites.
• Banking trojans rose 65% in Q4 2025.
• Joker malware resurfaced on Google Play, 263k installs.
• Threat targets phones, tablets, TVs, in‑car Android systems.

Pulse Analysis

The Telegram X backdoor underscores a growing supply‑chain vulnerability in the mobile ecosystem. By embedding Android.Backdoor.Baohuo.1.origin in unofficial builds, attackers gain silent, long‑term access to user accounts, enabling channel manipulation, message hiding, and credential harvesting. This technique exploits the trust users place in modified versions that promise extra features, especially in regions where alternative app stores dominate. Security teams must broaden detection rules to include anomalous Telegram activity and monitor third‑party distribution channels for tampered binaries.

Banking trojans surged by more than 65% in Q4 2025, reflecting attackers’ focus on direct financial theft. Variants of the Android.Banker family now deploy convincing fake banking interfaces and intercept SMS one‑time passwords, bypassing traditional two‑factor defenses. The rapid increase signals that fraudsters are refining social engineering tactics and leveraging the expanded attack surface of Android devices beyond smartphones, including tablets and in‑car infotainment systems. Organizations should enforce strict app vetting, employ mobile threat defense solutions, and educate users about the dangers of installing apps from unverified sources.

The Joker malware’s return to Google Play, achieving over 263,000 installs before removal, highlights persistent challenges in marketplace vetting. Joker disguises itself as legitimate utilities, then subscribes victims to paid services or redirects them to scam sites, generating revenue for cybercriminals. Its presence on the official store demonstrates that even curated platforms can be compromised, urging regulators and app store operators to enhance automated scanning and manual review processes. For businesses, the lesson is clear: continuous monitoring of app reputations and rapid response to emerging threats are essential to protect both corporate and consumer data.