The volume of mobile threats detected worldwide fell by almost nine million between the first quarter of 2021 and the first three months of 2022, according to new data from Kaspersky.

The Russian AV provider based its analysis on information collected from customer environments during the period.

A total of 6,463,414 mobile malware, adware and “riskware” attacks were blocked in Q1 2022, up from more than 15 million in Q1 2021.

The number of malicious installer packages detected also decreased over the period, by 64% to just 516,617.

The largest group of threat types was “risk management tools” applications, which accounted for almost half (49%) of the total. This is followed by adware, which accounts for around 17% of all mobile threats.

However, both of these categories saw a decline in numbers, unlike Trojans, whose share increased by 10 percentage points to almost 15%. The most impacting variants were Mobtes (44%), Piom (33%) and Boogr (14%).

Mobile banking Trojans have also seen an increase in detections of more than 113% since the first quarter of 2021, reaching nearly 54,000. Most of this increase has been attributed to Trojan-Banker.AndroidOS. Bray family, whose share accounted for 81% of all detected mobile banking Trojans.

Kaspersky also warned that many malicious apps have been found on legitimate app stores. These included fraudulent trading apps and scams claiming to dispense benefits or offer payday loans.

“It is not uncommon for apps posted in the store to come with inflated ratings with fake reviews posted on the app’s page which are of course all positive,” the report claims. “These types of apps occupy seven of the 20 spots in our malware rankings for the first quarter.”

Users in Iran (35%), China (27%), Yemen (21%) and Oman (19%) were most at risk in the first quarter of 2022.