By 
People ask me whether an Android phone can catch a virus. The honest answer starts with the word: Android has no classic viruses. It runs banking trojans, adware and spyware, mostly via sideloads and texts, not the Play Store.
I test on a Tecno Spark 40 running HiOS on Android 15. No malware was staged on it for this guide. Every figure carries its named source and read-date; whatever could not be re-verified says so.
The short version
- Yes, Android phones get infected. Mostly banking trojans and adware, mostly via sideloads and texts.
- The Play Store is defended, not safe. Google blocked 1.75 million apps in 2025, and some slipped through.
- Your risk is your habits and patch level, not your brand.
- Nigeria's fraud losses fell 51% to ₦25.85bn in 2025. A trend, not a finish line.
The numbers, dated: prevalence in one table
| Metric | Value | Source and quarter |
|---|---|---|
| Mobile attacks blocked | 1.67 million | Securelist Q3 2026 (12 Nov 2026) |
| Banker share of Q3 2026 detections | 31.63% | Securelist Q3 2026 (12 Nov 2026) |
| New malicious packages (Q3 2026) | 378,456 (119,688 banker) | Securelist Q3 2026 (12 Nov 2026) |
| Ransomware packages | 570 | Securelist Q2 2026 (12 Nov 2026) |
| Spike in banker-driven mobile threats | Fourfold | BusinessDay, 17 Sep 2025 (30 Sep 2026) |
| Apps blocked from Play in 2025 | 1.75 million; 80,000 accounts banned | Google, 19 Feb 2026 (30 Sep 2026) |
| Adware surge in 2025 | Up 90% | Malwarebytes, 16 Dec 2025 (30 Sep 2026) |
| Phones on Android 12 or older | About 1 billion devices; 42.1% | Moneycontrol, 8 Feb 2026 (12 Nov 2026) |
Securelist's Q3 2026 report, published 10 November 2026 by Anton Kivva and read 12 November 2026, is the lab record behind the rows. It counted 1,668,368 attacks, down from Q2's 1,996,823. The 1.67 million is attacks blocked, not infections confirmed.
Google's 2025 Play defence review (19 February 2026) carries the 1.75 million and the 80,000 accounts: the defender's half, kept beside the attacker's.
How it arrives: sideloads, texts, store slips
Three doors, and two of them are yours to close.
| Route | What the numbers say | Source |
|---|---|---|
| Sideloaded APKs | 3% of apps analyzed from outside Play contain malware (0.03% on Play) | Lookout, Mar 2026 (12 Nov 2026) |
| Sideloads, composition | Riskware and trojans account for 80% of the malware observed in sideloaded apps | Zimperium, Nov 2024 (12 Nov 2026) |
| Text links (smishing) | OTP theft at scale | Malwarebytes, 16 Dec 2025 (30 Sep 2026) |
| Play Store slips | 1.75 million blocked, yet 239 apps with about 42 million installs slipped through | Google, 19 February 2026; gHacks via vervali, second-hand |
Lookout calls the 3% persuasion, not exploit: the door is not forced, someone talks you into it.
Lookout's 2024 data: phishing exposure 26% on iOS, 12% on Android (read 30 September 2026). The old line that Android carries 50 times more malware than iPhone recycles 2010s-era reports, with no date and no denominator.
Malwarebytes' 2025 threats review (16 December 2025) documents OTP theft at scale. One-time-password interception turns a leaked credential into a drained account.
The cast: bankers, adware, spyware, ransomware, stalkerware
Virus versus malware is a wording fight, and the wording loses. A true virus copies itself. Nearly everything on Android is a trojan, adware or spyware that needs you to open it first.
Banking trojans lead 2025-2026: over half of Q1 2026 detections, and banker-driven threats spiked fourfold (BusinessDay, 17 September 2025, read 30 September 2026). Mamont is the name to know.
Adware jumped 90% in 2025 (Malwarebytes, 16 December 2025, read 30 September 2026). It is the least dramatic cast member: ads you did not ask for, metered against your data bundle.
439 new ransomware packages landed in Q1 2026 (Securelist, 18 May 2026, read 30 September 2026). DroidLock is the name to watch (Zimperium, 10 December 2025, read 12 November 2026).
Stalkerware is the human-harm end. EFF and AV-Comparatives' 2025 test, published 6 November 2025 and read 12 November 2026, checked 17 stalkerware products. Play Protect detected 53%; Trend Micro managed 59%; Malwarebytes detected all 17. The tell is permissions: accessibility and notification access.
iPhones vs Androids, honestly
Android leads raw malware volume: global share and an open install path. iPhones are not clean either.
The 50-times multiple still circulates as the iPhone-versus-Android answer. The figure recycles 2010s-era reporting, with no denominator and no date worth printing.
Malwarebytes' July 2025 analysis found iPhone owners more reckless, less protected online (read 12 November 2026). Habits travel with the owner.
Nigeria: bankers, smishing, loan apps, old phones
The honest loss curve from the NIBSS record: ₦17.67bn in 2023, internet-banking fraud up 325% that year (2023 report, April 2024, read 30 September 2026).
Losses rose to ₦52.26bn in 2024, driven by one ₦31.1bn incident. They fell to ₦25.85bn in 2025, down 51%, with Lagos at 63.43% of fraud activity (NIBSS, 22 January 2026, read 12 November 2026).
Read the fall correctly: a trend, not a solved problem. E-commerce and internet banking stay the most affected channels; social engineering stays the commonest technique, per the same update.
Ranked by likelihood:
- Smishing and OTP theft: scam texts pushing fake bank or wallet links. NDIC warns about these (read 30 September 2026).
- Fake banker apps sideloaded from texts or ads, including fake VPN-client lures (BusinessDay, 17 September 2025, read 30 September 2026).
- Loan apps that harvest your contacts as leverage after a missed payment.
- Unpatched old phones, sitting on the wrong side of the update line.
FIJ documented the route: numbers bought from leaks and loan-app contact lists (read 30 September 2026). Treat every fraud text as hostile.
If a text asks for an OTP, the bank is not asking. Banks never ask for OTPs by text.
Old phones: the billion-device question
Moneycontrol's report (8 February 2026, read 12 November 2026) puts about a billion phones on Android 12 or older. 42.1% of Android phones get no patches.
Old does not mean doomed. Update everything it still accepts. Bank in the app or the browser, never a texted link. Plan the replacement before banking apps stop supporting it.
What protects you: the short list
Habits, not products:
- Play Store only. Every APK link in a text is hostile.
- Updates, fast. Turn on auto-update and let it run overnight on Wi-Fi.
- Permissions, monthly. Accessibility and notification access are the two stalkerware needs. Settings search: "accessibility".
- The smishing pause. Ten seconds before any link. Banks do not text for OTPs.
- Source matters. An APK from the developer's site beats a mirror, because a mirror adds tampering to a risky file.
The antivirus decision page is researched and not yet live. If the phone already acts strange, our guide to stopping malware from destroying your phone covers removal. Fake-VPN lures stitch this arc to the privacy guides: a VPN is a tunnel, not a shield.
What I tested on a Tecno Spark 40, and what I could not verify
What this phone can vouch for: HiOS shows the patch level under a Settings search for "security update". Play Protect scans run from the Play Store. HiOS shuffles its labels between builds, so search by keyword, not by menu path.
No screen was shot for this guide. HiOS varies by build; an invented path would bounce the reader.
Lab figures are cited from the labs, at the read-dates printed beside them. No rate was re-measured on this Spark 40, and no malware was staged on it.
Securelist figures cross a Q3 2025 methodology recalculation. Any year-over-year chart drawn from them, ours included, keeps the caveat.
Questions readers ask
Is a virus the same thing as malware?
No. A virus copies itself. Nearly everything on Android needs you to open it: trojans, adware, spyware.
Is Android really 50 times riskier than iPhone?
It recycles 2010s-era reports with no denominator or date. The dated split: bankers at 52.96% of Q1 2026 detections; phishing 26% on iOS versus 12% on Android (Lookout 2024, read 30 September 2026).
Is the Play Store safe, then?
Safer, not safe. Google blocked 1.75 million apps in 2025. Some 239 apps with about 42 million installs slipped through, a second-hand figure (gHacks via vervali).
Is an APK from the developer's own site risky?
Less than a mirror site, never zero. The store screens; the developer site serves the file raw. Outside Play, you are the screener.
My phone is old and gets no updates. How bad is it?
About 42.1% of Android phones sit on version 12 or older, about a billion devices (Moneycontrol, 8 February 2026, read 12 November 2026). Bank in the app; plan the replacement.
NIBSS says fraud losses fell 51%. Is fraud solved?
No. One ₦31.1bn incident drove the 2024 peak. 2025 fell to ₦25.85bn, down 51%, and the technique did not change (NIBSS, 22 January 2026, read 12 November 2026).
The order that protects you: Play Store, patches, permissions, the ten-second pause. If it already happened, the removal guide is next; the Android problems hub carries the rest.
Comments
New posts held for reviewCouldn't load comments - the thread service didn't answer. Nothing is being hidden: no approved comments are saved with this page.
No approved comments yet - the first one is yours. New posts are held for review before they appear.