Mobile phishing and surveillanceware: what should security teams change?

TL;DR: Mobile threats are increasingly entering enterprise environments through phishing, malicious web content, vulnerable apps, and surveillanceware, alongside a 17% rise in enterprise-targeted phishing and web attacks and a 32.4% rise in malicious app detections, according to Lookout reports. The data shows mobile risk now sits inside identity, endpoint, and SOC workflows, not outside them.

Editorial analysis by NHI Mgmt Group, based on content published by Lookout: “Mobile Threat Landscape Report: Q3 2024”.

By the numbers:

• Lookout says 19% of enterprise iOS devices were exposed to at least one mobile phishing attack in each of the first three quarters in 2024.

Key questions

Q: What breaks when mobile phishing is not in place?

A: When mobile phishing resistance is weak, attackers can exploit urgency, small-screen trust, and messaging-app context to capture credentials or trigger MFA bypass.

Q: Why do mobile malware and surveillanceware increase enterprise account risk?

A: Because these threats can capture texts, one-time codes, contacts, and session-related data directly on the device.

Q: What are the signs that mobile device posture is failing?

A: Repeated exposure to outdated operating systems, unlocked devices, unencrypted storage, and vulnerable app versions are the clearest signs that mobile posture controls are not working.

Practitioner guidance

• Harden mobile authentication paths Require stronger conditional access for mobile sign-ins, especially where phishing, smishing, or executive impersonation could trigger MFA abuse.
• Integrate mobile telemetry into SOC workflows Feed mobile threat, browser, and app signals into SIEM and SOAR so phishing, malware, and suspicious device posture become visible in the same investigation queue as endpoint and identity alerts.
• Tighten app permission governance Review apps that can read messages, access the camera, microphone, location, or accessibility services, then revoke permissions that are not required for business use.

Bottom line: Mobile compromise often starts as a trust and identity problem on the phone, then turns into credential theft, account takeover, or surveillance.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →