A comprehensive review of Android malware: trends, behaviors, taxonomies, and future direction

Android malware behaviors (1900–1999)

Table 4 showcases the early Android malware evolution rate in the years 1900–1999 based on key variant features. Android malware in this era is less sophisticated and advanced due to its leverage on less advanced techniques that enable it to evade detection subtly on devices and exploit vulnerabilities for financial gain.

Figures 4 and 5 illustrate the trends, where the following abbreviations are used: YR=Year Range, AM=Android Malware, PA=Permission Abuse, MP=Malicious Payload, SP=Self-propagation, PE=Privilege Escalation, DET=Data Exfiltration and Theft, PSE=Phishing and Social Engineering, EL=Encryption and Locking, BRD=Battery and Resource Drain, BI=Botnet Integration, PMs=Persistence Mechanisms, C&C=Command and Control Communication, OE=Obfuscation and Evasion, P=Polymorphism, and H=Hybridization, V=Virus, W=Worm, BT=Bank Trojan, RATs=Remote Access Tools, R=Ransomware, ACF=Advertising Click Fraud, CM=Cryptomining Malware, LSO=Lock Screen Only (Pahlevan Sharif, Mura & Wijesinghe, 2019; Lecci & Cisewski, 2014; Lv et al., 2016; Okoli, 2015; Vaismoradi, Turunen & Bondas, 2013; Braun & Clarke, 2006).

Figure 4 depicts the malware’s evolution and behaviors (1900–1999). The dark blue shades represent the presence of a specific malware behavior, while the lighter shades denote the absence of a specific malware behavior. Based on the above chart, we discuss and categorize this era into subsections as follows:

Dominance of core malware behaviors: The malicious payloads and data exfiltration, are evident across various malware types, including viruses, worms, bank Trojans, and ransomware (Afianian et al., 2019). Self-propagation remains a significant feature of viruses and worms, facilitating their spread without requiring user intervention (Boukerche & Zhang, 2019). The prevalence of key malware behaviors, including malicious payload delivery and data theft, is driven by their capacity to steal sensitive data, corrupt systems, self-propagate, and exploit vulnerabilities across diverse malware families (Kuraku & Kalla, 2020).

Emergence of specialized threats: The bank Trojans and ransomware, highlights their targeted behavior, focusing on data theft, phishing, and encryption (Aslan et al., 2023). Privilege escalation appeared across diverse malware types but was not universally implemented (Rangwala et al., 2014). The surge in these threats can be attributed to their ability to focus on specific, high-value targets, emphasizing data theft, phishing, and privilege escalation (Ryan, 2021).

Limited advanced techniques: The botnet integration, command and control (C&C) communication, and obfuscation and evasion, were largely absent, indicating less sophisticated malware during this era (Catalano et al., 2022). Polymorphism and hybridization, which are critical for avoiding detection, were not utilized (Rendell, 2019). The limited advanced techniques observed in malware between 1900 and 1999 can be attributed to the lack of botnet integration, the absence of C&C communication, and the minimal use of obfuscation and evasion methods (Davanian, Faloutsos & Lindorfer, 2024).

Niche behaviors: Ransomware stood out with its unique screen-locking mechanism (Catalano et al., 2022). Advertising click fraud and cryptomining malware exhibited no significant behaviors from this list, showing minimal impact during this period. From 1900 to 1999, ransomware introduced its distinctive screen-locking mechanism, differentiating it from other malware types (Davanian, Faloutsos & Lindorfer, 2024). Unlike traditional malware, which typically aimed to destroy or steal data, ransomware prevented users from accessing their systems, demanding a ransom for restoration. This approach proved particularly effective by directly targeting user control over systems and data. However, other forms of malware, such as advertising click fraud and cryptomining, had minimal impact during this period. These behaviors, which gained prominence in later years, did not play a significant role in the 1900s (Rendell, 2019). Advertising click fraud, which involves inflating ad clicks, and cryptomining, which uses system resources for cryptocurrency mining, were not yet major concerns in the cybersecurity landscape of the 20th century (Alauthman et al., 2024).

Implications: This analysis captures the initial phases of malware development, characterized by limited sophistication and a primary focus on exploiting specific vulnerabilities (Catalano et al., 2022). In the period following 1999, malware trends likely evolved with greater complexity and the integration of advanced features as attackers responded to enhanced defensive strategies (Javed, El-Sappagh & Abuhmed, 2025).

Android malware behaviors (2000–2024)

Table 5 showcases the early Android malware evolution rate in the years 2000–2024 based on key variant features. Android malware in this era is super sophisticated and advanced due to its leverage on advanced techniques that enable it to evade detection, persist on devices, and exploit vulnerabilities for financial gain. Figure 2 depicts the distribution rate based on key features.

Figure 5 depicts the malware’s evolution and behaviors (2000–2024). The dark blue shades (1 shown in dark blue shades) represent the presence of a specific malware behavior, while the lighter shades (0 shown in light shades) denote the absence of a specific malware behavior. Based on the above chart, we discuss and categorize this era into subsections as follows:

Common behaviors across malware: Permission abuse and malicious payloads are observed among all the malware types and showed system infiltration as their respective modes of attack (Afianian et al., 2019). Also, privilege escalation and data filtration are utilized across various malware types consistently in their respective malicious activities. From 2000 to 2024, a common behavior across various malware types is the abuse of permissions and the use of malicious payloads, which demonstrate system infiltration as the primary attack method. Malware often exploits vulnerabilities to gain unauthorized access to systems or data. Once inside, malicious payloads—harmful components hidden within applications or files—execute damaging actions, such as data corruption, theft, or encryption (Ryan, 2021). Privilege escalation is another consistent behavior observed across malware types. This technique allows malware to elevate its access rights within the system, enabling it to perform unauthorized actions, such as installing additional malware or gaining control over administrative functions (Thakkar & Lohiya, 2022). Additionally, data filtration, where sensitive information is extracted and sent out of the system, is commonly used for malicious purposes such as theft or espionage (Tari et al., 2023).

Advanced techniques by sophisticated malware: Ransomware demonstrates the broadest range of behaviors, including encryption, locking, botnet integration, and hybridization, showcasing its adaptability and destructive potential (Bojarajulu, Tanwar & Singh, 2023). l. Bank Trojans and RATs exhibit comprehensive behaviors, particularly in persistence mechanisms and command and control (C&C) communication, emphasizing their use in targeted attacks. Sophisticated malware, especially ransomware, is notable for its diverse and destructive behaviors. Ransomware is particularly known for its ability to encrypt and lock files, integrate with botnets, and, in some cases, hybridize with other malware types, which enhances its impact and adaptability across various attack scenarios. This flexibility makes ransomware especially hazardous from 2000 to 2024, as it rapidly adjusts to different targets and environments (Bojarajulu, Tanwar & Singh, 2023). Bank Trojans and RATs display distinct but complementary behaviors. Both malware types employ advanced persistence techniques to remain active on infected devices. They also rely extensively on C&C communication to maintain control over compromised systems and execute specific attacks, such as stealing banking credentials and gaining remote access for further malicious actions (Bécue, Praça & Gama, 2021).

Emerging trends: Newer malware types (cryptomining malware and advertising click fraud) share traits such as resource drain and polymorphism and show their respective evolution in monetization strategies via resource exploitation. Emerging malware types, particularly cryptomining malware and advertising click fraud, share key characteristics such as resource drainage and polymorphism, making them adaptable and harder to detect (Ørmen & Gregersen, 2023). Cryptomining malware, also known as cryptojacking, exploits a victim’s computing resources to mine cryptocurrencies like Bitcoin, draining power and CPU resources without consent (Almurshid et al., 2024). This malware has evolved in its approach, making it harder to distinguish from legitimate activity and offering attackers a consistent monetization model based on resource exploitation (Almurshid et al., 2024). Similarly, advertising click fraud involves manipulating online advertising systems by generating false clicks, leading to resource consumption on both the victim’s system and advertising platforms (Bojarajulu, Tanwar & Singh, 2023). This type of malware also exhibits polymorphic behaviors to evade detection while contributing to fraudulent gains (Bojarajulu, Tanwar & Singh, 2023). These newer forms of malware have continuously evolved since 2000, capitalizing on resource exploitation as a central monetization strategy (Ørmen & Gregersen, 2023).

Legacy malware: Viruses and Worms display limited adaptability with fewer behaviors related to advanced evasion techniques. Their relevance appears to have diminished as more sophisticated threats have emerged. Legacy malware, such as viruses and worms, shows limited adaptability and exhibits fewer behaviors related to advanced evasion techniques compared to more sophisticated, modern threats (Bécue, Praça & Gama, 2021). These older malware types primarily rely on basic propagation methods like exploiting system vulnerabilities or human error, but they lack the polymorphic and advanced behaviors seen in contemporary threats. The development of more evasive techniques, such as anti-detection measures and advanced persistence mechanisms, has shifted the focus toward more advanced malware like ransomware, bank Trojans, and remote access tools (RATs), which are far more adaptable and capable of evading modern defenses. As a result, the relevance of traditional viruses and worms has diminished, giving way to more complex and targeted cyberattacks that take advantage of advanced technologies and strategies to compromise systems (Almurshid et al., 2024). Despite their reduced prominence, legacy malware still poses risks due to their ability to evade outdated defenses and exploit unpatched vulnerabilities.

Polymorphism and hybridization: These are increasingly prominent in advanced malware (ransomware), reflecting an emphasis on adaptability to evade detection. Polymorphism and hybridization have become essential techniques in advanced malware, particularly ransomware, as cybercriminals enhance their ability to evade detection (Bojarajulu, Tanwar & Singh, 2023). Polymorphism involves modifying the code or appearance of malware each time it runs, making it harder for signature-based detection systems to recognize it. Hybridization combines multiple evasion methods, such as static and dynamic analysis, to further complicate detection efforts by blending different techniques to bypass security measures. These strategies are especially prevalent in ransomware attacks, which often use advanced machine learning and deep learning methods to avoid detection. Ransomware variants continuously evolve by altering their code or adopting new behaviors to outpace traditional detection systems (Almurshid et al., 2024). Furthermore, deep learning models and hybrid detection approaches, which merge static and dynamic analysis, are used to detect these threats more effectively, though they still face difficulties in dealing with highly adaptive malware.

Implication: This analysis highlights the advanced stages of malware development, characterized by high sophistication. It examines various techniques, including polymorphism, hybridization, vulnerability exploitation, encryption, and locking, employed to evade detection and facilitate malicious activities. This period is marked by increasing complexity and the integration of enhanced features as attackers continuously adapt to evolving defensive measures.

Android malware families distribution on various geographical regions

In this subsection, we analyse and discuss the various Android malware families’ distributions across numerous geographical regions. Table 6 depicts the various advanced Android mobile malware families based on key behaviors, platform, and impacted regions. Figure 6 showcases the malware families’ distributions in various regions of the world, and in this map chart, the X-axis represents the infected regions, while the Y-axis denotes the malware families. The color intensity reflects the severity rate and infestation frequency in the respective regions. In Table 6, AMT=Advanced Malware Type, CF=Corresponding Families, RI=Region Infected, HA=Hash Algorithm, O=Obfuscation, DM=Defence Mechanism, H(B)=Hybridization (Bundleware), P=Polymorphism, S=Severity, E=Evolution, PI=Platform Infected, PM=Propagation Mode.

Figures 6, 7 and Table 6 highlight the global distribution of malware threats, emphasizing the regions of China, the USA, and Russia as critical hotspots. In this analysis, we highlight and discuss the key factors contributing to the severity, diversity, and geographical concentration of malware threats, providing deeper insights into the evolving cybersecurity landscape:

High severity and frequent infestations: Regions such as the USA, China, and Russia serve as breeding grounds for malware due to their heavy reliance on digital infrastructures and vast online user bases. Advanced banking systems in these regions make them ideal targets for malware like the Zeus Trojan, which exploits vulnerabilities in financial institutions to steal sensitive data. The interconnectedness of their systems amplifies the impact, turning local infections into widespread threats through network propagation.

Diversity of malware families: The varied functionalities of malware families, including CryptoLocker (file-encrypting ransomware) and Ryuk (used in targeted attacks), demonstrate how attackers exploit multiple vectors, from phishing campaigns to vulnerabilities in unpatched systems. Despite their functional differences, these malware types share a reliance on social engineering tactics, making them versatile and difficult to predict. This diversity underscores the need for comprehensive defense mechanisms that address both individual and enterprise-level threats.

Cybersecurity gaps and infrastructure vulnerabilities: The presence of outdated software and insufficient security measures in regions like Russia, Ukraine, and India creates an environment where adware (e.g., Conduit) and dialer-based malware (e.g., DropDialer) thrive. These gaps indicate the prevalence of poor cybersecurity hygiene and limited awareness, reinforcing the urgent need for widespread adoption of advanced security tools and practices.

Economic and geopolitical factors: Regions with significant geopolitical influence, such as China, the USA, and Russia, are prime targets for ransomware like Bad Rabbit and Ryuk. These attacks focus on critical infrastructure, including energy grids, healthcare, and government systems, which are integral to both the economy and national security. The high stakes of these sectors make them lucrative targets for ransomware campaigns aimed at extortion or disruption.

The interplay between technological dependence, malware diversity, cybersecurity gaps, and geopolitical importance creates a multifaceted threat landscape. Addressing these challenges requires a combination of robust technological defenses, user education, and international collaboration to mitigate risks and reduce the prevalence of high-severity malware.

Android malware families’ severity distribution on various platforms and behaviour count

In this subsection, we analyse and discuss Android malware families’ severity distribution across various platform and behaviour count. Figure 8 showcases the malware families’ distributions on key platforms, and in this map chart, the X-axis represents the key platforms, while the Y-axis denotes the malware severity distribution counts. Figure 9 showcases the Android malware propagation count based on various variant behaviors.

To highlight significant trends in malware targeting and propagation techniques, shedding light on evolving threats in cybersecurity, we discuss and analysis these significances based on the following:

Platform targeting: Figure 8 demonstrates the steady surge in the Android severity counts, PCs, and IoT devices, suggesting that Android has emerged as the most targeted platform, primarily due to its open-source nature and vast user base, offering attackers numerous vectors to exploit. IoT devices rank second, reflecting their increasing adoption and weak security implementations, which often lack robust update mechanisms. PCs, while still a focus, are targeted less than Android and IoT, likely due to improved security measures on modern desktop systems.

Advanced propagation techniques: Figure 9 demonstrates a steady rise in the polymorphism, hybridization, severity rate, and obfuscation, suggesting that most modern malware demonstrates hybridization, where different malicious techniques are combined to maximize impact and evade detection. Polymorphism allows malware to change its code structure frequently, while obfuscation disguises malicious payloads from security tools. These behaviors are particularly effective against signature-based detection systems, highlighting the sophistication of recent threats.

Surge in evolutionary malware: Figure 9 demonstrates a steady curve rise in the polymorphism, hybridization, severity rate, and obfuscation. The observed surge in polymorphism, severity rate, hybridization, and obfuscation reflects malware’s adaptability. Attackers now prioritize stealth and persistence, enabling prolonged infiltration to maximize data theft or system damage.

These findings underscore the urgent need for enhanced AI-driven threat detection systems and better user awareness programs to mitigate malware risks across all platforms.

Limits of hybrid and explainable AI in advanced mobile malware detection

Pan & Mishra (2023) developed a hardware-assisted, explainable AI framework for malware detection that uses hardware performance counters and trace buffers to localize malicious behavior. Their approach balances detection accuracy with interpretability by comparing decision trees and recurrent neural networks (RNNs). Bakır & Bakır (2023) discovered that combining auto-encoder-based feature extraction with machine learning algorithms significantly improves Android malware detection. Their model, DroidEncoder, demonstrated strong performance using artificial neural networks (ANNs), convolutional neural network (CNN), and VGG19-based auto-encoders to extract features, which enhanced the accuracy of traditional classifiers. Scalas, Rieck & Giacinto (2023) show that explainable machine learning improves malware detection by making model decisions transparent. They use feature attribution methods to identify key behaviors, enhancing both accuracy and interpretability.

Alsubaei et al. (2025) propose a BERT-ensemble framework for Android malware detection that achieves high accuracy (98%) and strong precision and recall by analyzing app permissions. The model is effective and privacy-aware for IoT applications. Alwaisi et al. (2024) present a lightweight TinyML-based anomaly detection method for IoT systems, achieving over 96.9% accuracy with low resource usage using on-device Decision Trees. Chimeleze et al. (2024) propose a lightweight Android malware detector that uses a hybrid fuzzy C-means with simulated annealing (FCMSA) for clustering app permissions, followed by LightGBM for classification. Wajahat et al. (2024b) introduced advanced feature engineering combined with machine learning techniques to improve Android malware detection, achieving higher accuracy and resilience against evolving threats. Wajahat et al. (2023) proposed an adaptive semi-supervised deep learning framework for Android malware detection. Their model leverages both labeled and unlabeled data, improving detection accuracy while reducing dependency on large labeled datasets. Wajahat et al. (2024a) developed a deep learning-based scheme for Android malware detection that optimizes performance metrics and computational resource usage, enhancing both efficiency and accuracy. Qureshi et al. (2021) analyzed key challenges in modern network forensic frameworks, highlighting issues such as data volume, encryption, real-time analysis, and the need for scalable, efficient forensic solutions. Azeem et al. (2020) examined the impact of code cloning in mobile applications, revealing that it can lead to increased maintenance costs, security vulnerabilities, and reduced code quality.

Figure 10 depicts the hybrid and explainable AI in advanced mobile malware detection frameworks and associated limitations.

Despite notable progress in detection accuracy and interpretability, current Android malware detection approaches remain limited by poor adaptability to evolving threats, overreliance on static features, and insufficient real-time and contextual analysis; highlighting the need for more resilient, adaptive, and context-aware solutions.

Proposed enhanced Android malware taxonomy

In this first subsection, to enhance the existing Android taxonomy, we explore ways to enhance the existing Android malware taxonomies based on the findings in categories 1–2. The improved taxonomy aims to aid APT analysts, researchers, and users in understanding the subcategorization of advanced Android malware based on key features. In this enhanced Android malware taxonomy, we examine, evaluate, and introduce the two key features: memory-based (fileless) and file-based elements. Figure 12 depicts the enhanced Android malware taxonomy.

In this enhanced advanced Android malware taxonomy, we subcategorize them into two primary types: memory-based (file-less) and file-based.

Subcategory One: Memory-Based Malware: Memory-based Android malware exploits vulnerabilities or manipulates processes within the device’s memory (RAM) to compromise the Android operating system. This malware evades traditional detection methods by residing in the device’s volatile memory, making it challenging to detect APT threats. Memory-based advanced malwares are categorized into three types, discussed as follows:

Type 1: This type is associated with these key features:

Device-based: exploits hardware or firmware vulnerabilities, hinders device performance, and potentially compromises sensitive data.

CPU-based: Targets the device’s CPU to manipulate and disrupt operating system performance and unauthorized activities.

USB-based: Injects malicious code into device memory via USB connections from infected external devices, leading to unauthorized access or data theft.

UEFI-based: The Unified Extensible Firmware Interface (UEFI) is exploited during device boot to compromise firmware, aiding the APT threats.

Network-based: The network protocol vulnerabilities are exploited, facilitating unauthorized access or data exfiltration through smartphone network connections.

Hypervisor-based: Targets the hypervisor layer, compromising the virtualized platform and potentially breaching Android OS defense.

Type 2: This type is associated with these key features:

Script-based Infection (SI): This infection exploits vulnerabilities in Android applications and the operating system to infiltrate device memory by executing malicious scripts, compromising device security through unauthorized actions.

Disk-based: This malware stores harmful code directly on the device’s storage, aiming to execute it and impact memory and data theft.

Memory-injection: This technique injects malicious code into the device’s volatile memory (RAM), hindering detection techniques performance. Dynamic Link Library (DLL) and process injection are employed in these injection attacks. Memory injection is subdivided into:

(a) ShellCode Injection: This injects malicious shellcode into a process’s memory to execute unauthorized commands and improve malware detection performance.

(b) Reflective DLL Injection: Malware injects DLLs into memory without traditional loading mechanisms, evading malware detection.

(c) Process hollowing: This malicious code replaces a legitimate process’s memory to evade defense detection.

(d) Inline hooking: This modifies program execution flow to redirect control to malicious code, allowing unauthorized activities in the Android OS.

Type 3: This type is associated with these key features:

Fileless Ransomware: This type operates in the Android device’s memory with no traces on the disk. It embeds malicious code in documents and scripts using native languages; macros execute ransomware attacks without traditional file storage; this makes it hard to detect.

Macro-Based: The macros exploit documents, such as Microsoft Word or Excel; this malware embeds malicious macros. When users open the document, the macros execute, infecting the Android device. This method relies on user interaction to initiate the malware’s actions.

File-Based: Involving executable files containing malicious code on the Android device, this malware is downloaded, installed, or executed, leading to various malicious activities. It was subdivided into:

(a) Worms: These exploit vulnerabilities in the Android system’s memory, self-replicating in the device’s memory, to spread to connected smartphone devices. Worm consumes system resources and network bandwidth and hinders device performance.

(b) Viruses: The device’s memory file is infected by a virus, modifying files and attaching to executable programs or documents. When executed or shared, viruses spread and hinder device performance.

(c) Trojans: Disguised as legitimate applications or files, Trojans operate in the device’s memory once installed, performing malicious activities such as data theft and unauthorized access.

Subcategory Two: File-Based Malware: File-based Android malware operates via traditional file techniques—applications and scripts—to exploit vulnerabilities and perform unauthorized actions on Android devices. It spreads via app downloads, email attachments, or file sharing. Memory-based malware relies on unique files for malicious activities. Improved Android malware in this subcategory is:

Acroforms-based: exploits PDF Acroforms to execute malicious actions.

Macro- and Javascript-based: Uses malicious macros and JavaScript to execute harmful commands.

Dynamic Data Exchange (DDE)-based: Allows data exchange between apps, posing defense risks in Word.

Digital Signature-Based: Manipulates digital signatures to appear legitimate.

Embedded Object-Based: The embedded objects are used to attack upon file opening.

Hyperlink-based: The hyperlinks are explored to direct users to malicious sites.

Review Comments and Metadata: Hidden malicious code in comments manipulates metadata to evade detection.

Significance of the enhanced Android malware taxonomy

In this second subsection, we discuss and emphasize the significance of the proposed enhanced Android malware taxonomy in addressing emerging malware threats.

Firstly, fileless malware, which operates by executing malicious code directly in memory rather than on the device’s file system, evades traditional file-based scanning methods. This type of malware exploits system tools to bypass detection mechanisms. The proposed taxonomy incorporates features of fileless malware, ensuring that future Android defense systems are better equipped to address these sophisticated, memory-resident threats (Kara, 2023). Secondly, file-based malware, though generally easier to detect, continues to evolve with advanced evasion techniques such as polymorphism, hybridization, encryption, and concealment within the file system (Sheen & Ramalingam, 2015). These adaptations complicate detection efforts. Current malware taxonomies often overlook these critical attributes, posing significant security challenges and limiting the effectiveness of Android malware defenses. The proposed taxonomy addresses this gap by categorizing and analyzing file-based malware features, offering detailed insights into their threat patterns, mechanisms, and evasion strategies.

By integrating features of both fileless and file-based malware, the enhanced taxonomy provides a comprehensive understanding of the diverse techniques malware uses to infiltrate and persist on Android devices. This framework is crucial for improving existing detection methods and advancing the development of robust, future-proof Android malware defense systems.