Mobile phishing and BYOD: what security teams need to fix now

TL;DR: 1.2 million enterprise employees were exposed to mobile phishing attacks in Q2 2025, a 20% quarter-on-quarter increase that reflects how personal smartphones, BYOD usage and inconsistent visibility are expanding the attack surface beyond traditional endpoint controls, according to Lookout. Human trust on mobile now matters as much as device hardening.

Editorial analysis by NHI Mgmt Group, based on content published by Lookout: “Malware Families, Mobile Threats, and the Human Risk Narrative Shaping Cybersecurity”.

By the numbers:

• 1.2 million enterprise employees were exposed to mobile phishing attacks in Q2 2025.
• That figure was a 20% increase from the previous quarter.
• 72% of organizations reported a rise in cyberattacks like phishing, smishing, or generative AI-augmented attacks over the past year.

Key questions

Q: How should security teams reduce AI-powered phishing risk on mobile devices?

A: Use layered controls that assume the attacker can imitate both identity and content.

Q: Why do personal mobile devices increase phishing and smishing risk?

A: Personal devices mix work and private behaviour, which makes users more likely to trust messages delivered through text, chat or voice channels.

Q: What are the signs that mobile threat detection is not enough?

A: If teams can see malware alerts but cannot tie them to device posture, OS version, and access eligibility, detection is not influencing trust decisions.

Practitioner guidance

• Define mobile trust boundaries for BYOD Separate fully managed, partially managed and unmanaged phones in policy so access decisions reflect the level of control you actually have over each device.
• Instrument mobile-specific EDR coverage Tune detection and response workflows for mobile app installs, suspicious links, proxy behaviour and network-based anomalies that do not appear in desktop telemetry.
• Train users on mobile phishing patterns Use text, voice and app-based impersonation examples in awareness content so employees recognise attacks that arrive outside corporate email.

Bottom line: Mobile phishing is exploiting the gap between personal-device trust and enterprise access control.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →