Mobile Threat Statistics Guide: Malicious Apps, Smishing and Device Exploits

Phones now carry corporate email, MFA approvals, banking and generative AI tools, but the mobile threat numbers that reach security teams are usually vendor headlines with no edition, method or denominator. This page gathers current mobile threat statistics from primary sources: Google's Play and Play Protect figures for 2025, Apple's App Store fraud prevention figures for 2025, the Kaspersky mobile threat report for 2025, the Google Threat Intelligence Group (GTIG) 2025 zero-day review, the Verizon 2025 Mobile Security Index and the Zimperium 2025 Global Mobile Threat Report. Each figure is given with its publisher, report and period, and vendor telemetry and vendor surveys are labelled as such. It is for SOC and detection engineers, mobile and endpoint teams, fraud teams and CISOs who need to size mobile risk honestly. Last reviewed: November 2026.

Key takeaways

• Official stores block enormous volumes before users see them. Google says it prevented more than 1.75 million policy-violating apps from being published on Google Play in 2025, and Apple says it rejected more than 2 million problematic App Store submissions in the same year.
• The risk has moved outside the stores. Google Play Protect identified more than 27 million new malicious apps from outside Google Play in 2025 and blocked 266 million risky installation attempts through its enhanced fraud protection.
• Banking Trojans are growing fast. Kaspersky counted 255,090 new mobile banking Trojan installation packages in 2025, a several-fold increase, while overall new malicious packages fell by nearly a third.
• Mobile zero-days increased. GTIG tracked 15 mobile operating system zero-days exploited in 2025, up from 9 in 2024, and for the first time attributed more zero-days to commercial surveillance vendors than to traditional state espionage groups.
• Phishing by text and voice is the main human route. Zimperium reports smishing as 69.3% of mobile phishing attacks in its 2025 data, and the Verizon 2025 Mobile Security Index finds 39% of organisations that ran smishing tests saw up to half their staff click.

Headline statistics

Statistics by theme

App store abuse and malicious apps

• Scale of scanning: Google says Play Protect scans more than 350 billion Android apps daily, and the Play Integrity API handles more than 20 billion checks a day. Enhanced fraud protection, which blocks sideloaded apps requesting sensitive permissions, now covers 185 markets and more than 2.8 billion devices, and blocked more than 872,000 unique high-risk apps in 2025.
• Bait and switch: Apple removed nearly 59,000 apps for bait-and-switch tactics and rejected more than 22,000 submissions for hidden or undocumented features in 2025. Apps that change behaviour after review are why store vetting alone is not a mobile control. See the APK sideloading guide.
• Payment fraud: Apple stopped more than 5.4 million stolen credit cards from being used on the App Store in 2025 and rejected more than 1.1 billion fraudulent account creations.
• Reading these numbers: both platforms publish what they blocked, not what got through. They show attacker volume, not user infection rates.

Mobile malware trends

• Volume: Kaspersky's mobile threat report for 2025 (4 March 2026) records 14,059,465 blocked attacks involving malware, adware or unwanted mobile software, about 1.17 million a month, and 815,735 new malicious installation packages, down nearly a third on 2024. Kaspersky changed its methodology from Q3 2025 and recalculated 2024, so earlier editions are not directly comparable.
• Banking Trojans: new banker packages rose several-fold to 255,090, and total banker attacks grew 1.5 times. The Mamont family accounted for 49.8% of banker apps and Creduz 22.5%.
• Adware still dominates: adware made up 62% of detections in Kaspersky's 2025 data, led by MobiDash, Adlo and HiddenAd.
• Preinstalled firmware malware: Kaspersky reports the Keenadu backdoor, found in Q4 2025, injected into device firmware during manufacturing, and Triada, a firmware backdoor that reached ninth place in its top 20 at 2.79% of attacked users. Low-cost devices and Android TV boxes are the usual carriers, so device sourcing is a control.
• Trojans in attacks: Zimperium's 2025 report records a 50% year-on-year increase in the use of Trojans in attacks in its customer data.

Kaspersky's telemetry is weighted towards regions where its products are widely used, including Russia, Türkiye, India and Brazil, so regional families such as Mamont should not be read as global prevalence. See the Mobile Malware Guide for how these families operate.

Exploits, zero-days and spyware

• Zero-day count: GTIG's 2025 zero-day review counts 90 zero-days exploited in the wild in 2025, of which 15 were in mobile operating systems, up from 9 in 2024. GTIG does not split the mobile figure between Android and iOS in its published review.
• Who exploits them: GTIG attributed more 2025 zero-days to commercial surveillance vendors than to traditional state-sponsored espionage groups for the first time since it began tracking. Commercial spyware is the main reason mobile zero-days matter to journalists, executives and officials. See the Commercial Spyware Guide.
• Enterprise shift: 43 of the 90 zero-days (48%) targeted enterprise technologies, and browsers accounted for less than 10%. Mobile is a smaller share of zero-day exploitation than enterprise edge devices, but it is rising.

Phishing, smishing and vishing

SMS phishing of employees is a proven route to corporate compromise, as the Twilio Breach 2022 showed when texted lures captured staff credentials and opened a path to downstream customers. See the Vishing and Smishing Guide.

Device and app hygiene

• Outdated operating systems: Zimperium's 2025 report finds more than 50% of devices in its data run outdated or compromised operating systems, and more than 25% cannot upgrade to the latest OS version at all.
• App weaknesses: the same report finds more than 60% of iOS apps and up to 34% of Android apps lack basic code protection, and nearly 60% of iOS apps and 43% of Android apps are vulnerable to personal data leakage. These are Zimperium's own app analysis results.
• Post-quantum on phones: Cloudflare reports iOS requests using post-quantum key agreement rose from under 2% to 11% within four days of the iOS 26 release, showing how quickly OS updates change mobile security baselines when devices can upgrade.

Organisational exposure

• Attack trend: 85% of organisations in the Verizon 2025 Mobile Security Index report increasing mobile attacks, and 75% increased mobile security spending in the past year. Verizon's press release does not state the sample size, so treat these as directional.
• Impact: 63% of organisations reported major problems from downtime and 50% suffered data loss linked to mobile security incidents (Verizon 2025 MSI).
• Generative AI on phones: 93% say employees use generative AI on mobile devices for daily work, and 64% see data compromise through generative AI as their top mobile risk (Verizon 2025 MSI).
• Small versus large organisations: advanced MFA is in place at 57% of large enterprises against 45% of SMBs, and mobile security training at 66% against 56% (Verizon 2025 MSI).
• BYOD: 70% of organisations support bring your own device and build mobile apps for employees and customers (Zimperium 2025).

What the numbers mean for detection teams

Log sources worth bringing into the SOC: MDM or UEM compliance changes and jailbreak or root detections, mobile threat defence alerts, identity provider sign-ins with device compliance state, app attestation failures from Play Integrity or App Attest in your own apps, and user reports of suspicious texts. See the MITRE ATT&CK for Mobile Guide and the Mobile App Attestation guide.

How to turn these statistics into a mobile detection programme:

1. Inventory first: list every device that reaches corporate data, its OS version, ownership model and management state. Unmanaged access paths are the gap the figures above describe.
2. Set compliance policy in report-only mode: apply minimum OS version, no sideloading and no root or jailbreak as conditional access rules in audit for two weeks, review who would be blocked, then enforce for a pilot group. Rollback is switching the policy back to report-only.
3. Feed mobile signals to the SIEM: forward MDM, mobile threat defence and identity provider device-state events, and write detections for sideloaded installs, compliance drift and sign-ins from non-compliant devices.
4. Harden the human route: replace SMS and push approvals with phishing-resistant MFA for privileged and finance staff first, and give users a one-tap way to report smishing.
5. Prepare for spyware: identify high-risk users, enable platform protections for them and agree a triage path. See the Mobile Spyware Infection Response Playbook.

Metrics that show mobile risk is falling:

• Managed coverage: share of devices accessing corporate data that are enrolled and compliant.
• Patch currency: share of devices within one OS minor version of the latest release, and count of devices that cannot upgrade.
• Sideload events: number of non-store app installs on managed devices per month, target falling.
• Smishing resilience: click rate and report rate in mobile phishing simulations.
• Phishing-resistant MFA: share of privileged users not relying on SMS or push approvals.

Common failure patterns when using mobile threat statistics

• Reading blocked counts as infection rates: Google's 1.75 million and Apple's 2 million figures are what was stopped. They say nothing about how many users were compromised.
• Mixing telemetry and surveys: Kaspersky and Zimperium count events in their customer base, Verizon reports what respondents believe. Do not combine them into one rate.
• Ignoring regional bias: vendor telemetry reflects where the vendor sells. A banking Trojan that dominates one country's numbers may be rare in yours.
• Assuming store-only installs are safe: bait-and-switch removals (nearly 59,000 at Apple in 2025) show apps can change after review.
• Treating the phone as outside identity scope: phones hold MFA factors, session tokens and passkeys. A compromised phone is an identity incident, which is why credential capture by text, as at Twilio, spread to customers.

Methodology notes and caveats

Practitioner checklist

• State publisher, report, period and method (telemetry, platform data or survey) for every mobile figure you quote.
• Inventory all devices reaching corporate data and their management state.
• Block sideloading on managed devices and alert on non-store installs.
• Enforce a minimum OS patch level through conditional access, piloted in report-only mode.
• Move privileged and finance users to phishing-resistant MFA.
• Forward MDM, mobile threat defence and device-state sign-in events to the SIEM.
• Buy devices from approved sources to limit firmware-level backdoors.
• Define a spyware triage path for high-risk users.
• Re-check the figures when Google, Apple, Kaspersky, GTIG, Verizon and Zimperium publish new editions.

Standards and references

• Google Threat Intelligence Group: 2025 Zero-Day Review
• Google: Keeping Google Play and Android app ecosystems safe in 2025
• Apple: The App Store stopped over USD 2.2 billion in fraudulent transactions in 2025
• Kaspersky Securelist: Mobile threat report 2025
• Verizon: 2025 Mobile Security Index press release
• Zimperium: 2025 Global Mobile Threat Report press release
• MITRE: ATT&CK for Mobile matrix
• Cloudflare: Radar 2025 Year in Review

Related NHI Mgmt Group resources: Mobile Device Security Guide, Mobile Malware Guide, Mobile Threat Defense Buyer's Guide, Malware Statistics, MFA Adoption Statistics.