Loading story…
A surge in mobile malware activity has been observed, with new threats targeting Android devices and leveraging advanced techniques for data theft and evasion. Notable incidents include the evolution of Android SMS stealers in Uzbekistan, the distribution of MacSync malware via signed Swift applications on macOS, and the exposure of malicious npm packages designed to steal WhatsApp messages. Security researchers have also highlighted the use of HWP-based DLL side-loading attacks and the deployment of malicious Chrome extensions masquerading as VPNs to intercept user traffic and exfiltrate credentials.
In addition to these technical findings, recent newsletters and security reports have provided comprehensive overviews of the mobile threat landscape, summarizing key malware campaigns and research advancements. These include the publication of datasets for malware classification, the application of graph neural networks for Android malware detection, and forensic insights into attacks targeting endpoint detection and response (EDR) solutions. The ongoing monitoring and analysis underscore the need for heightened vigilance and advanced detection strategies to counter the rapidly evolving mobile malware ecosystem.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Security Affairs published Malware Newsletter Round 77, summarizing recent malware-related developments including Android SMS stealers in Uzbekistan, RansomHouse encryption changes, Iranian APT activity, MacSync distribution, malicious NPM package abuse, and credential-stealing Chrome extensions.
AhnLab ASEC published its Mobile Security & Malware report for the 4th week of December 2025, summarizing observed Android APK threats and highlighting malware families such as Cellik and Kimwolf.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers have observed a significant increase in mobile malware and spyware activity affecting both Android and Apple devices in late September 2025. According to AhnLab’s ASEC Blog, the fourth week of September saw a notable rise in malicious Android APKs, with particular targeting in regions such as Indonesia and Vietnam. Attackers have been leveraging smishing campaigns to distribute malware, often disguising malicious applications as legitimate software, including those related to OnePlus OxygenOS. These campaigns aim to steal sensitive user data, credentials, and financial information from unsuspecting victims. Concurrently, a French government advisory highlighted a surge in sophisticated spyware attacks against Apple users, specifically those with iCloud-linked devices. The advisory, reported by Zimperium and originally covered by Dark Reading, revealed that attackers are exploiting zero-day vulnerabilities in Apple’s ecosystem. Victims often receive threat notifications from Apple months after the initial compromise, indicating a delay in detection and response. The French CERT-FR warned that these spyware campaigns are highly targeted and may involve advanced persistent threat actors. The exploitation of zero-day vulnerabilities allows attackers to bypass traditional security measures and gain persistent access to devices. Both Android and Apple users are at risk, with attackers employing a variety of social engineering tactics, including phishing and smishing, to lure victims into installing malicious payloads. The increase in mobile threats underscores the need for heightened vigilance among users and organizations, particularly in regions identified as hotspots for malware distribution. Security experts recommend regular software updates, the use of reputable security solutions, and user education to mitigate the risk of infection. The cross-platform nature of these attacks demonstrates the evolving sophistication of mobile threat actors. Organizations are advised to monitor for indicators of compromise and to respond swiftly to any signs of unauthorized access. The reports from both AhnLab and Zimperium highlight the global scale of the threat, with attackers adapting their techniques to exploit vulnerabilities in both major mobile operating systems. The ongoing campaigns serve as a reminder of the critical importance of mobile security in the current threat landscape.
Jun 29, 2026
Security researchers have highlighted several emerging threats and concerns in the mobile security landscape during early October 2025. The ASEC Blog reported on the latest mobile malware issues, focusing on Android threats such as ClayRat, ProSpy, and ToSpy. These malware families are known for their capabilities to exfiltrate sensitive data, monitor user activity, and potentially gain unauthorized access to device resources. The report underscores the increasing sophistication of mobile malware targeting Android devices, with attackers leveraging social engineering and malicious applications to compromise users. Security experts emphasize the importance of keeping mobile operating systems and applications updated to mitigate these risks. The proliferation of mobile malware is attributed to the widespread use of smartphones for both personal and professional activities, making them lucrative targets for cybercriminals. The report also notes that threat actors are continuously evolving their tactics to bypass security controls and evade detection. In addition to malware, concerns have been raised about the security implications of mobile device management (MDM) policies in academic environments. Researchers warn that mandating staff and students to enroll personal devices in university MDM systems could inadvertently introduce new vulnerabilities. If the central MDM infrastructure is compromised, attackers could potentially gain access to a large number of personal devices, amplifying the impact of a breach. The debate centers on balancing the need for institutional security with the privacy and autonomy of individual device owners. Experts recommend that organizations carefully assess the risks and benefits of MDM deployment, especially when it involves personal devices. They also suggest implementing robust security measures for MDM platforms, including strong authentication and regular security audits. The ongoing discussion reflects broader concerns about the intersection of mobile security, privacy, and organizational control. As mobile threats continue to evolve, both technical defenses and policy decisions play a critical role in safeguarding users and data. The reports from early October 2025 serve as a reminder of the dynamic and complex nature of mobile security challenges. Organizations are urged to stay informed about the latest threats and to adopt a multi-layered approach to mobile device protection. The convergence of malware threats and policy-driven risks highlights the need for comprehensive mobile security strategies. Security professionals are encouraged to monitor threat intelligence feeds and adapt their defenses accordingly. The evolving threat landscape requires constant vigilance and proactive risk management to protect against both technical and policy-related vulnerabilities.
Jun 29, 2026
A significant increase in mobile malware activity was observed in Q4 2025, with Doctor Web reporting that adware trojans such as Android.MobiDash and Android.HiddenAds remained the most prevalent threats, though their detection rates declined. Conversely, banking trojans, particularly from the Android.Banker family, saw a 65.52% rise in activity, targeting users by intercepting SMS one-time codes and mimicking legitimate banking apps. The review also highlighted the widespread use of unwanted software like CloudInject, which adds dangerous permissions and obfuscated code to apps, as well as riskware programs modified with NP Manager. Additionally, Doctor Web identified new threats such as the Android.Backdoor.Baohuo.1.origin, distributed via modified Telegram X apps to steal credentials, and the unique Trojan.ChimeraWire, which manipulates website popularity metrics. Globally, India experienced a 38% year-over-year increase in mobile malware attacks, accounting for 26% of all mobile malware traffic worldwide, according to Zscaler. Hundreds of malicious apps, many disguised as productivity tools, infiltrated trusted platforms like the Google Play Store, with over 42 million downloads. Attackers focused on high-value industries, with retail, hospitality, and manufacturing sectors being primary targets. The escalation in Android malware transactions and the strategic targeting of consumer-facing and operations-heavy environments underscore the evolving tactics of threat actors and the growing risks to mobile device users and organizations worldwide.
Jun 29, 2026