Loading story…
Recent surveys reveal a significant decline in consumer trust toward digital services and highlight risky cybersecurity behaviors among users, particularly on mobile devices. The Thales Consumer Digital Trust Index 2025 found that no sector achieved high trust ratings from even half of its users, with banking leading at only 44% and government services being the only sector to see a year-over-year increase. The report underscores that consumers feel overwhelmed by the responsibility of managing their own digital security, with 63% believing brands place too much onus on them and 82% having abandoned a brand in the past year, often due to excessive data-sharing demands.
Simultaneously, a Zimperium survey shows that consumers are increasingly using smartphones for sensitive activities such as banking and authentication, yet continue to engage in insecure practices like password reuse and installing apps without reviewing permissions. As mobile threats such as phishing and malicious apps proliferate, these behaviors heighten the risk of compromise. Both reports emphasize the urgent need for organizations to improve security measures and user experience to restore trust and reduce exposure to cyber threats.
See the actors and campaigns active against you right now.
1 event from the most recent confirmed update back to the earliest known activity.
Two 2025 consumer-focused reports summarized on November 26, 2025 found that mobile users increasingly perform sensitive activities on phones while still engaging in risky behaviors, and that consumer trust in digital services has declined across surveyed sectors. The findings highlighted growing exposure to phishing, malicious apps, and device exploits, along with dissatisfaction over data protection burdens, service disruptions, and digital friction.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat intelligence reports from multiple security vendors highlight a significant escalation in mobile malware activity and the evolution of attack strategies targeting mobile devices in 2025. Kaspersky's Q3 2025 statistics reveal that over 47 million attacks involving malware, adware, or unwanted mobile software were prevented, with trojans being the most prevalent threat. The Zscaler Threatlabz report, corroborated by Zimperium's research, documents a 67% year-over-year increase in Android malware and a 50% rise in trojan deployments, with 18% of sampled mobile devices found to be infected. These reports emphasize the growing adoption of a mobile-first attack strategy by threat actors, exploiting the expanded enterprise attack surface as remote and hybrid workforces rely more heavily on mobile devices. A notable trend is the persistence and evolution of mobile banking malware. Zimperium's analysis details the emergence of the Android/BankBot-YNRK trojan, which masquerades as legitimate apps, abuses accessibility services, and automates fraudulent transactions, reinforcing the risk to mobile banking users. The convergence of phishing techniques—such as smishing, vishing, and quishing—under the term "Mishing" further illustrates the sophistication of mobile-targeted social engineering. Collectively, these findings underscore the urgent need for organizations to strengthen mobile security controls and user awareness as mobile devices become a primary vector for credential theft, financial fraud, and enterprise compromise.
Jun 29, 2026
Verizon's 2025 Mobile Security Index highlights a significant and growing risk to enterprise cybersecurity stemming from the widespread use of personal mobile devices for work purposes. Employees are increasingly targeted by cyberattacks on their personal phones, with smishing—SMS-based phishing—emerging as a particularly effective vector due to users' higher trust in mobile communications compared to email. Attackers exploit this trust, sending convincing messages about unpaid tolls, expiring offers, or job opportunities, which users are more likely to engage with. Once compromised, these personal devices can serve as conduits for attacks on corporate networks, especially when organizations fail to implement robust mobile security measures. Despite the availability of effective mobile security solutions that can significantly reduce both the success rate and impact of such attacks, many companies are slow to adopt them, focusing their efforts more on desktop security. The risk is compounded by the fact that employees often use their own devices for work, blurring the line between personal and professional security responsibilities. Researchers have further demonstrated that the BYOD threat landscape now extends beyond phones to include other personal devices, such as cars. At BSides NYC, a proof-of-concept attack was presented in which a car was used as an initial access vector: an attacker compromised a phone via the car, and then leveraged the phone's connection to infiltrate corporate Linux servers and ESXi hypervisors. This attack chain required only inexpensive equipment and exploited the trust and connectivity between personal devices and corporate networks. The demonstration underscores that attackers will often choose the simplest and least monitored path, such as exploiting the connectivity between a car and a phone, rather than attempting to breach heavily defended endpoints directly. Security experts warn that organizations must not overlook these unconventional but viable attack vectors, as even companies with advanced security postures can be vulnerable if they neglect the security of personal devices and their integration with corporate systems. The growing sophistication and creativity of attackers in leveraging BYOD risks highlight the urgent need for comprehensive mobile and endpoint security strategies. Companies are advised to reassess their security policies, ensuring that all potential entry points—including personal vehicles and mobile devices—are adequately protected. Failure to address these blindspots can result in successful breaches that bypass traditional security controls. The evolving threat landscape demands that organizations stay vigilant and proactive in securing all devices that can access corporate resources, not just those traditionally considered part of the enterprise IT environment. As attackers continue to innovate, the importance of holistic security measures that encompass both personal and corporate devices becomes increasingly clear. The findings from Verizon and the research community serve as a wake-up call for enterprises to close the mobile security gap before it leads to further data breaches. Ultimately, the convergence of personal and professional device usage requires a new approach to risk management, one that anticipates and mitigates the full spectrum of BYOD threats.
Jun 30, 2026
UK reporting highlighted persistent weaknesses in baseline cyber hygiene and a growing expectation that **phishing and social engineering** will succeed against many organizations. A Vodafone Business-commissioned snapshot cited by Tech Radar/SC Media reported that **63% of UK businesses** feel more exposed to cyberattacks than a year ago, **71% of leaders** think employees are vulnerable to phishing, and staff reuse work passwords across an average of **11 personal accounts**; only **45%** of organizations said all staff had completed basic cyber awareness training. The same coverage noted increasing concern about **AI-enabled scams and deepfakes**, with **70%** reporting greater suspicion of video calls impersonating senior leaders, and pointed to the UK government’s planned *Telecommunications Fraud Charter* as part of broader anti-fraud efforts. Separately, the Bank of England’s 2025 CBEST review (summarized by The Register) found that regulated financial firms and **financial market infrastructures (FMIs)** still commonly fail on fundamentals observed during **13 CBEST assessments and regulator-backed penetration tests**, including **weak access controls**, poor password practices, **misconfigured and inconsistently patched systems**, and gaps in **intrusion detection** and vulnerability management. The report emphasized that firms should be prepared to **handle breaches** rather than relying only on preventive controls, and that weak security culture enables attackers to bypass controls via social engineering; it also warned that inadequate helpdesk identity-verification processes can enable fraudulent credential access, with the NCSC noting such tradecraft aligns with groups like **Scattered Spider**.
Jul 12, 2026