India tops APAC in mobile threat detections as attacks turn more targeted

From fake reward apps to AI-generated messages, cybercriminals are finding new ways to target mobile users, Kaspersky analysis shows

India recorded 18,187 mobile threat detections in the first quarter of CY 2026, the highest among the Asia-Pacific markets tracked in Kaspersky's latest analysis. Indonesia came second with 15,163 detections, while China recorded 6,797 cases.

 

The figures come as mobile threats across APAC become increasingly concentrated. Attackers are going after fewer users, but hitting the same victims again and again. Across the eight markets Kaspersky studied, the average number of threat detections per affected user jumped 49 per cent year-on-year in Q1 2026, from 4.9 to 7.3. This rise held across all eight markets even as the total number of users encountering mobile threats actually fell.

 

Why India's numbers stand out

India's detection count isn't just the highest in the region, it also comes with malware campaigns that are clearly built around how Indian mobile users actually behave.

 

Kaspersky flags two threats in particular. The Rewardsteal Trojan continues to be active in India, posing as reward or giveaway apps to steal sensitive information. There's also been a comeback of the Thamera Trojan, which hijacks devices and uses them to churn out fraudulent social media accounts at scale.

The findings are particularly relevant given how central smartphones have become in India, whether it's digital payments, social media, government services or shopping. That familiarity is exactly what attackers exploit, building scams around services and habits users already trust.

Scams are spreading into messaging apps and social media

Kaspersky says it's seeing more scam activity built around fake promotions, phishing pages, malicious ads, fraudulent surveys and other social engineering tactics. Phishing is still one of the most common methods, with attackers relying on fake domains, typosquatting and lookalike copies of trusted brands to make their fraudulent sites appear real.

 

What's changed is where these links are showing up. Attackers are no longer sticking to email; they're spreading through text messages, messaging platforms, social media, fake job offers, crypto giveaways and digital promotions. Compromised messaging accounts work especially well for this because a malicious link coming from a friend, colleague or family member's account looks far more trustworthy than one from a stranger.

Credentials for messaging services and government portals are high on the list of what attackers want. Once they get access, it opens the door to identity theft, fraud and further attacks on the victim's other accounts.

Some attacks barely need the victim to do anything

One of the more concerning findings is how little interaction some of these attacks now require. In certain cases, simply visiting a compromised webpage is enough to get exposed. Other campaigns unfold in stages, starting with something that looks completely harmless (a file, a link, a message) before it leads to the actual malicious payload.

 

This is what makes mobile threats so hard to catch early. The first step often doesn't look risky at all. A user doesn't necessarily install anything obviously suspicious or type their password into an obviously fake site. The attack builds gradually from something ordinary.

 

India's Rewardsteal and Thamera campaigns are good examples of how targeted this can get. Rewardsteal banks on people's interest in rewards and giveaways to steal data, while Thamera has been tied to mass creation of fake social media accounts.

AI is making these scams harder to spot

Artificial intelligence is now adding another layer of difficulty to social engineering. In a separate global study, The Great Messaging Heist, Kaspersky found that 66 per cent of victims believed AI had been used against them in some form.

 

AI-written messages were the most common form at 42 per cent, followed by generated or cloned voices at 31 per cent and deepfake images or videos at 25 per cent. Scammers are using these tools to impersonate people victims already trust, including family members, and craft urgent, convincing requests for money or credentials.

 

Speed is also a factor. Kaspersky found that 52 per cent of successful scams were completed in under 30 minutes, from first contact to the moment money or personal information actually changed hands.