Mobile phishing and device out-of-date gaps: what should teams do?

TL;DR: 2023 saw record mobile phishing attempts against enterprise users, more than 260 iOS CVEs published, and 52.8% of risky mobile devices running out-of-date OS versions, according to Lookout, showing how social engineering and delayed patching combine to widen exposure. Mobile security now fails at the user, app, and device layers at once, so governance must shift from awareness to enforceable control.

Editorial analysis by NHI Mgmt Group, based on content published by Lookout: “Mobile Threat Landscape Report: 2023 in Review”.

By the numbers:

• There were more than 260 iOS CVEs published in 2023.
• 52.8% of risky mobile devices were out-of-date OS devices.

Key questions

Q: What breaks when mobile phishing is not in place?

A: When mobile phishing resistance is weak, attackers can exploit urgency, small-screen trust, and messaging-app context to capture credentials or trigger MFA bypass.

Q: Why do out-of-date mobile devices increase enterprise risk?

A: Out-of-date devices keep known vulnerabilities exposed long after disclosure, especially when operating system patches are available but not yet installed.

Q: What are the signs that mobile security hygiene is failing in an organisation?

A: Common warning signs include unmanaged devices, weak or shared passwords, outdated operating systems, delayed app updates, and employees logging in from unsecured public Wi-Fi.

Practitioner guidance

• Enforce mobile phishing resistance controls Block high-risk message and link interactions on managed mobile devices, and require users to verify unexpected requests through a separate trusted channel.
• Tie access to device compliance signals Use device posture, OS version, and lock status as access inputs so that out-of-date or unlocked devices do not retain the same trust level as compliant devices.
• Prioritise remediation for shared mobile components Track Chromium, WebP, JavaScript engine, and shared library exposure across browser and app fleets because one component flaw can affect multiple apps at once.

Bottom line: Mobile threats now combine phishing, exploitation, and posture drift into a single enterprise governance problem.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →