Topic starter
25/10/2026 11:05 am
TL;DR: Mobile-focused social engineering reached more than 4,000,000 attacks in 2024, and iOS users saw twice as many phishing interactions as Android users, according to Lookout. Mobile access now has to be governed as an identity surface, not just a device layer.
Editorial analysis by NHI Mgmt Group, based on content published by Lookout: “Lookout Mobile Threat Landscape Report - 2024 in Review”.
By the numbers:
- Phishing interactions on iOS were 100% higher than on Android.
Key questions
Q: Why do mobile phishing attacks create risk even on managed iOS fleets?
A: Because the attack is usually web-based or message-based, not platform-specific.
Q: What are the signs that mobile vulnerability management is failing?
A: Out-of-date OS versions, vulnerable app builds, rooted or jailbroken devices and large exception pools are the clearest warning signs.
Q: What breaks when mobile devices are not treated as first-class enterprise endpoints?
A: Security teams lose visibility into an early compromise path that often precedes broader intrusion.
Practitioner guidance
- Prioritise mobile telemetry in the SOC Feed mobile device, app and web threat data into SIEM, SOAR or XDR so mobile activity is visible alongside email and endpoint signals.
- Enforce mobile phishing protections at the identity layer Monitor mobile access to SSO portals, messaging apps and authentication workflows for impersonation, fake login pages and suspicious device context.
- Harden device compliance policies Require current OS versions, device lock, encryption and non-rooted status before a mobile device is allowed to hold enterprise trust.
Bottom line: Mobile threats are increasingly the opening move in intrusion chains, which makes the handset an identity surface as much as an endpoint.
Glossary terms: Mobile Phishing, Surveillance Spyware, Device Posture, Mobile Threat Intelligence
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:15 pm
Mobile targeting is now an intrusion signal, not just an endpoint issue. Attackers often begin with the device that carries identity, messaging and browser trust, because that is where users are most likely to approve, click or hand over credentials. That means mobile telemetry belongs in the same security conversation as SSO, MFA and endpoint detection. Organisations that ignore mobile as a first-touch attack surface are reading the attack too late.
A question worth separating out:
Q: How should security teams connect mobile risk to broader identity governance?
A: They should treat device posture as part of access trust, especially where mobile devices can reach SSO, email or sensitive business apps. If a phone can still authenticate while being rooted, unpatched or manipulated by spyware, the identity programme is accepting a compromised trust anchor. That changes access decisions, not just endpoint reporting.
👉 Read our full editorial: Mobile targeting is the early warning sign teams keep missing
This post was modified 7 days ago by NHI Mgmt Group