Kaspersky: Android customers infected with mobile ransomware hit 136K in April 2016, nearly quadrupling from March 2015
Context & Ripple Effects
Kaspersky's April 2016 count of 136,000 infected Android customers lands on top of an already steep mobile curve: mobile malware infections rose 25% in 2014 to around 16 million devices, so the near-quadrupling in ransomware specifically marks ransomware catching up to where general mobile malware already was.
The timing matters because 2016 was the year ransomware went industrial — Trend Micro later measured 752% growth and $1B in revenue for ransomware that year — and this data point shows the mobile platform being pulled into that economy rather than standing apart from it.
First-order effects
- Android users become a direct ransomware target class rather than collateral: Kaspersky's own customer base is absorbing the infections, shifting mobile security from adware cleanup toward extortion-response scenarios.
Second-order effects
- With ransomware proving profitable enough to fund expansion across platforms, attackers have an economic incentive to port campaigns to Android, which is exactly what the subsequent surge in Android banking malware attacking ~1.8M users in 2018, up over 300% YoY reflects.
Third-order effects
- If mobile ransomware keeps compounding, removal becomes the structural weak point — researchers later found 14.8% of targeted Android users left with an infected system partition that resists cleanup, pushing the industry toward deeper OS-level defenses rather than app-scanning alone.
The trend: Ransomware is evolving from a Windows-desktop extortion business into a multi-platform one, with Android adoption following the same monetization curve that drove its 2016 PC-era boom.