Android in 2026: the scam starts with a phone call

A long call, step by step

Group-IB, a security company, published the case on 12 August 2026 and says it targeted people in Czechia, Slovakia and Slovenia[S1]. The caller walks the owner through installing an app from outside the official store. The report says the app’s label can carry the owner’s own name, which helps it look as if it belongs on the phone. Once installed, it gives the caller remote control, and the caller uses that control to install a second app, WindRelay.

WindRelay reads the owner’s payment card over NFC, the short-range wireless technology behind contactless payments, and streams the card data live to a fake terminal. The owner’s own PIN then approves the transactions. In the documented case a loan was also taken in the owner’s name through the banking app. Group-IB describes two cash-out routes: a digital loan, and card-present purchases or cash withdrawals[S1]. Google says it found no copies on Google Play and that Play Protect covers known versions[S2].

The report names no victims and neither does this article. The regional focus is Group-IB’s assessment, and we have not tested it.

The toolbox: accessibility, overlays, screen capture

The same few abilities recur across this year’s reports. Zimperium, a mobile-security company, said in April that four malware families together target more than 800 banking, crypto and social apps. As reported, they arrive as sideloaded installers, use accessibility services and screen capture to see what the owner types and views, and draw fake overlays on top of real apps[S5]. In June, Malwarebytes described a family it calls Rokarolla, drawing on Zimperium’s analysis: fake TikTok and Chrome installers on rogue sites, a first stage that impersonates Google Play Protect, overlays for more than 200 banking and crypto apps, a fake lock screen that captures a PIN or pattern, and interception of one-time codes sent by SMS[S4].

Accessibility services exist so that people with disabilities can use a phone. That is why malware wants them: a service that can read the screen and tap buttons can act as the owner. An app that holds the permission does not need to exploit anything to watch what happens next.

The numbers, and what they cannot say

Kaspersky reported fewer new malicious or unwanted Android installation packages in 2025 than in 2024, with banking trojans the fast-growing part[S8]. The data comes from opt-in users of Kaspersky’s Android products. It counts packages, not phones or victims, and it does not describe every Android device. Google separately reports that Play Protect identified a very large number of new malicious apps outside Google Play in 2025, a figure Google compiled itself and one that counts apps, not people[S9].

The direction is informative even though the totals are not a prevalence rate: fewer packages overall, but more of them built to move money.

An AI model in the loop

In February, ESET reported what it called the first Android malware to use a generative AI model in its execution flow[S3]. The model’s job is small. It interprets the screen state so the malware can keep itself pinned in the recent-apps list. The core is older: a remote-access module, capture of the lock-screen PIN, and invisible overlays on the Uninstall and Stop buttons so that removal requires Safe Mode. ESET says the sample was distributed from a dedicated website aimed at Argentina, was not seen in its telemetry, and may be a proof of concept[S3]. It shows where experimentation is heading, not that AI-driven malware is widespread.

The old route is still open

Not every threat needs a conversation. In October, Bitdefender described a platform-signed system app in the firmware of low-cost phones. It cannot be uninstalled and can install or remove apps and grant permissions without asking. Bitdefender saw thousands of devices in many countries over about two years, and says the link between the firmware certificates and a manufacturer is a supply-chain link, not proof that the company wrote the code or knew of it[S11]. We name no brands. In this case the problem arrived with the phone.

What Google says it is changing

Google’s developer-verification plan ties apps on devices licensed for Google services to a registered developer identity. Apps on Google Play are registered automatically; users who want unverified apps would use an advanced flow with extra steps and a waiting period. Google’s page sets 30 September 2026 for the start in Brazil, Indonesia, Singapore and Thailand, and 2027 for devices licensed for Google services worldwide[S6]. We could not confirm that enforcement began on that date, and the plan does not ban sideloading. Press coverage of Android 16 adds that settings linked to sideloading and accessibility are blocked while a call is in progress[S7], which would interrupt the pattern above.

Our assessment: the owner is the entry point

The Lab reads this year’s Android reports as one story told four ways. The call, the lookalike installer, the AI-assisted trick and the preinstalled app differ in craft, but each ends with an app holding powers the owner did not mean to give. Platform fixes help at the margin; the decisive moment is still an owner under pressure.

That has a practical consequence for evidence. When the attack is the owner’s own action, there may be no exploit to find. What remains is a set of ordinary-looking facts: an app that arrived from somewhere other than the official store, special access it was granted, and a pattern of contact with an unfamiliar service. Each is mundane alone and meaningful together.

What the Lab is watching

• Whether Google’s developer-verification enforcement starts as planned, and what it does to sideloaded installs.
• Whether the AI-assisted technique ESET described[S3] moves from proof of concept to something seen in the wild.
• Further reporting on preinstalled firmware malware, including any manufacturer response.
• The August 2026 Android bulletin, which we have not been able to read in full.

What this means for examiners

A call from a bank that asks the owner to install an app, grant accessibility access or read out a code is a warning in itself; the safer path is to hang up and call the bank on a number found independently. For anyone examining such a phone afterward, an app installed from outside the official store at a caller’s direction is the first thing to look for.

In four lines. It arrives by voice call and a sideload. It is an installable app package, often labeled for the individual victim[S1]. It may leave the app itself, the special access it holds and background network sessions. Android keeps less than iOS: Amnesty’s forensic team noted in 2021 that Androids "do not log the kinds of information required" for its work[S10], so many Android examinations come down to what the app inventory shows.