Mobile threat telemetry: are your controls keeping up?

TL;DR: Enterprise employees were exposed to more than 1,200,000 mobile phishing attempts, while 100+ new and updated malware families and multiple browser zero-days kept mobile devices in the attack path, according to Lookout's Q2 2025 mobile threat landscape report. The finding is that mobile is now an identity and endpoint governance problem, not just a device-management problem.

Editorial analysis by NHI Mgmt Group, based on content published by Lookout: “Lookout Mobile Threat Landscape Report - Q2 2025”.

By the numbers:

• 15% of iOS devices with MDM were exposed to mobile phishing attacks, a 2% increase from Q1.

Key questions

Q: What breaks when mobile security is treated as a lower-priority endpoint problem?

A: Identity assurance breaks first.

Q: Why do mobile phishing attacks create such a high compromise risk?

A: They work because the device is already trusted, always nearby, and often used for fast approvals.

Q: What are the signs that mobile controls are not keeping up with threat activity?

A: Look for large gaps between managed-device enrollment and actual exploit visibility, repeated phishing exposure on mobile channels, delayed OS updates, and a lack of mobile telemetry in incident workflows.

Practitioner guidance

• Build mobile into identity risk scoring Treat mobile phishing, suspicious prompts, and app-based credential capture as identity-risk signals that can raise user risk, trigger step-up authentication, or suspend access.
• Extend SOC telemetry to mobile devices Ingest mobile threat, posture, and web-filtering signals into the SOC so analysts can correlate phishing, malware, and exploit activity with account compromise indicators.
• Tighten mobile device posture enforcement Require current OS versions, device lock, and encryption on managed phones and tablets, then monitor for drift rather than assuming MDM enrollment equals protection.

Bottom line: Mobile phishing is now a direct identity risk because the same device used for communication is also used for authentication and access.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →