Loading story…
Security researchers have observed a significant increase in mobile malware and spyware activity affecting both Android and Apple devices in late September 2025. According to AhnLab’s ASEC Blog, the fourth week of September saw a notable rise in malicious Android APKs, with particular targeting in regions such as Indonesia and Vietnam. Attackers have been leveraging smishing campaigns to distribute malware, often disguising malicious applications as legitimate software, including those related to OnePlus OxygenOS. These campaigns aim to steal sensitive user data, credentials, and financial information from unsuspecting victims. Concurrently, a French government advisory highlighted a surge in sophisticated spyware attacks against Apple users, specifically those with iCloud-linked devices. The advisory, reported by Zimperium and originally covered by Dark Reading, revealed that attackers are exploiting zero-day vulnerabilities in Apple’s ecosystem. Victims often receive threat notifications from Apple months after the initial compromise, indicating a delay in detection and response. The French CERT-FR warned that these spyware campaigns are highly targeted and may involve advanced persistent threat actors. The exploitation of zero-day vulnerabilities allows attackers to bypass traditional security measures and gain persistent access to devices. Both Android and Apple users are at risk, with attackers employing a variety of social engineering tactics, including phishing and smishing, to lure victims into installing malicious payloads. The increase in mobile threats underscores the need for heightened vigilance among users and organizations, particularly in regions identified as hotspots for malware distribution. Security experts recommend regular software updates, the use of reputable security solutions, and user education to mitigate the risk of infection. The cross-platform nature of these attacks demonstrates the evolving sophistication of mobile threat actors. Organizations are advised to monitor for indicators of compromise and to respond swiftly to any signs of unauthorized access. The reports from both AhnLab and Zimperium highlight the global scale of the threat, with attackers adapting their techniques to exploit vulnerabilities in both major mobile operating systems. The ongoing campaigns serve as a reminder of the critical importance of mobile security in the current threat landscape.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Zimperium published a report stating that a French advisory had revealed a surge in spyware activity targeting Apple devices. The supplied content does not include the advisory date or further incident specifics, so the publication date is used.
AhnLab ASEC released its 'Mobile Security & Malware Issue 4st Week of September, 2025' report summarizing mobile security and malware developments for the fourth week of September 2025. The reference does not provide specific underlying incident details in the supplied content.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A surge in mobile malware activity has been observed, with new threats targeting Android devices and leveraging advanced techniques for data theft and evasion. Notable incidents include the evolution of Android SMS stealers in Uzbekistan, the distribution of MacSync malware via signed Swift applications on macOS, and the exposure of malicious npm packages designed to steal WhatsApp messages. Security researchers have also highlighted the use of HWP-based DLL side-loading attacks and the deployment of malicious Chrome extensions masquerading as VPNs to intercept user traffic and exfiltrate credentials. In addition to these technical findings, recent newsletters and security reports have provided comprehensive overviews of the mobile threat landscape, summarizing key malware campaigns and research advancements. These include the publication of datasets for malware classification, the application of graph neural networks for Android malware detection, and forensic insights into attacks targeting endpoint detection and response (EDR) solutions. The ongoing monitoring and analysis underscore the need for heightened vigilance and advanced detection strategies to counter the rapidly evolving mobile malware ecosystem.
Jun 29, 2026
A significant escalation in zero-click and zero-day exploitation techniques was observed throughout 2025, with attackers increasingly targeting mobile platforms such as iOS. Zero-click exploits, which require no user interaction, have become a preferred method for advanced persistent threats, nation-state actors, and commercial surveillance vendors. At least 14 major zero-click vulnerabilities were identified, affecting billions of devices and highlighting the growing attack surface beyond traditional user-driven threats. The average time from vulnerability disclosure to exploitation has dropped dramatically, putting pressure on organizations to accelerate patching cycles and improve detection capabilities. Recent reports confirm that multiple zero-day vulnerabilities in iOS were actively exploited in targeted spyware campaigns before patches became available. Attackers leveraged flaws in core mobile components, such as browser engines, to execute malicious code and compromise devices with minimal or no user involvement. These incidents underscore the persistent risks posed by mobile spyware and the critical need for rapid patching, enhanced mobile OS visibility, and continuous monitoring for anomalous device behavior as mobile endpoints remain high-value targets for cyber adversaries.
Jun 29, 2026
A significant increase in mobile malware activity was observed in Q4 2025, with Doctor Web reporting that adware trojans such as Android.MobiDash and Android.HiddenAds remained the most prevalent threats, though their detection rates declined. Conversely, banking trojans, particularly from the Android.Banker family, saw a 65.52% rise in activity, targeting users by intercepting SMS one-time codes and mimicking legitimate banking apps. The review also highlighted the widespread use of unwanted software like CloudInject, which adds dangerous permissions and obfuscated code to apps, as well as riskware programs modified with NP Manager. Additionally, Doctor Web identified new threats such as the Android.Backdoor.Baohuo.1.origin, distributed via modified Telegram X apps to steal credentials, and the unique Trojan.ChimeraWire, which manipulates website popularity metrics. Globally, India experienced a 38% year-over-year increase in mobile malware attacks, accounting for 26% of all mobile malware traffic worldwide, according to Zscaler. Hundreds of malicious apps, many disguised as productivity tools, infiltrated trusted platforms like the Google Play Store, with over 42 million downloads. Attackers focused on high-value industries, with retail, hospitality, and manufacturing sectors being primary targets. The escalation in Android malware transactions and the strategic targeting of consumer-facing and operations-heavy environments underscore the evolving tactics of threat actors and the growing risks to mobile device users and organizations worldwide.
Jun 29, 2026