Cybersecurity 101 | What is Mobile Malware?| Cloudskope

Mobile malware now matches enterprise threat sophistication. Banking trojans, mercenary spyware, and supply chain attacks against iOS and Android.

The Mobile Malware Categories Enterprises Should Track

The mobile malware landscape is more category-diverse than its desktop counterpart. Unlike the relatively consolidated Windows malware ecosystem, mobile threats span at least five distinct categories that present different defensive challenges.

Banking and Credential Trojans

Banking trojans — Anatsa, SharkBot, BRATA, Octo, GoldDigger — are the most prevalent enterprise-relevant mobile malware category. They typically deliver through legitimate-looking applications on Google Play or sideloaded APKs. Once installed, they request accessibility service permissions, then use those permissions to overlay phishing screens over legitimate banking applications, intercept SMS-based MFA codes, and exfiltrate credentials. The 2024-2025 Anatsa campaigns specifically targeted European banking apps and are estimated to have compromised hundreds of thousands of accounts.

Mercenary Spyware

Commercial spyware sold by vendors including NSO Group (Pegasus), Cytrox (Predator), Intellexa, and others provides zero-click iOS and Android compromise with no user interaction required. Initial infection vectors have included iMessage and WhatsApp message parsing vulnerabilities, malicious calendar invites, and network-level exploits delivered via cellular interception. Once installed, mercenary spyware provides total device access — microphone, camera, location, messages, encrypted communications. The 2023-2025 disclosures from Apple's Threat Notification program identified targeted users across more than 100 countries.

Supply Chain SDK Compromise

Some mobile malware enters through legitimate applications that include compromised third-party SDKs. The application developer is not malicious; an upstream SDK has been compromised at the vendor level or replaced with a malicious variant during the build pipeline. The 2024 SpinOK SDK incident affected over 100 Android applications collectively downloaded more than 400 million times. The defensive challenge is severe: traditional app-reputation controls treat the parent application as legitimate because the developer is legitimate.

Stalkerware and Consumer Surveillance Apps

Stalkerware applications marketed as parental controls or employee monitoring tools are operationally indistinguishable from mercenary spyware once installed. They run in stealth mode, intercept communications, track location, and report to a remote dashboard. Enterprise concern centers on the threat from a stalker who has physical access to install the application, but the broader risk is that stalkerware infrastructure has been repurposed by criminal groups for non-targeted surveillance campaigns.

Cryptominers and Adware

The lowest-tier mobile malware category — cryptominers and aggressive adware — accounts for the majority of detected mobile threats by volume but the minority by impact. These categories drain battery, consume bandwidth, and may serve as a foothold for more sophisticated subsequent payloads, but they rarely produce the kind of executive-attention incident that banking trojans and mercenary spyware do.

Why Mobile Malware is Now an Enterprise Risk

The Authentication Surface

The single most important shift in mobile threat exposure is that mobile devices now hold the primary authentication factor for most corporate systems. SMS-based MFA codes arrive on mobile devices. Authenticator applications run on mobile devices. Biometric authentication for corporate VPN and SaaS access uses the mobile device's hardware. A successful mobile malware infection on a single employee's phone can compromise the authentication surface for that employee's entire corporate application portfolio.

This is not a theoretical concern. The Anatsa and BRATA campaigns specifically target the intersection of banking application use and MFA interception. Mercenary spyware operators routinely extract authentication state for Microsoft 365, Google Workspace, and major SaaS applications. The mobile device has become the single point of failure for identity in many enterprise architectures.

The BYOD Visibility Gap

Most mid-market organizations operate a partial BYOD environment — corporate-owned devices for some users, personal devices for others, contractor devices outside corporate management entirely. Even within corporate-owned device fleets, mobile device management (MDM) coverage frequently lags well behind endpoint coverage on laptops. The visibility gap is structural: organizations cannot see whether their employees' mobile devices have been compromised because the organizations do not have telemetry from those devices.

The Executive Targeting Pattern

For senior executives, board members, M&A team members, and individuals with access to highly sensitive data, the mobile threat model is qualitatively different from the average employee. Mercenary spyware vendors maintain customer relationships with state actors who use the capability against specific named individuals. Targeted spear-phishing campaigns increasingly deliver mobile-specific payloads. Public records, social media, and corporate communications make executive targeting operationally straightforward in ways the same techniques are not for the broader workforce.

The App Store Trust Model

The implicit trust model that mobile users apply to applications downloaded from Google Play and the Apple App Store is poorly calibrated to current threat reality. Google Play has hosted hundreds of malicious applications collectively downloaded by tens of millions of users across the past 36 months. Apple's App Store has a stronger track record but is not immune — App Store review does not catch SDK-level compromises, post-approval malicious updates, or applications that load malicious code dynamically from remote servers. The defensive assumption that app store presence implies safety is operationally false.

How to Defend the Mobile Threat Surface

Mobile Device Management as the Foundation

Microsoft Intune, Jamf Pro for iOS, Google Workspace Endpoint Management — the MDM platform is the foundation of mobile defense. MDM provides device compliance enforcement, application allowlist controls, OS version requirements, encryption verification, and remote wipe capability. For corporate-owned devices, MDM should be mandatory. For BYOD scenarios, application management (MAM) without full MDM provides a partial alternative that can secure corporate data without controlling the entire device.

Mobile Threat Defense Tooling

Beyond MDM, dedicated mobile threat defense (MTD) tooling — Lookout, Zimperium, Wandera, Check Point Harmony Mobile — provides on-device detection of malicious applications, network attacks, and OS-level compromise indicators. Most MTD platforms integrate with MDM to automate device quarantine when threats are detected. For organizations whose threat model includes targeted mobile compromise — executive teams, M&A staff, regulated industries — MTD deployment is the appropriate next layer above MDM.

Application Allowlisting and Sideload Prevention

The single most effective preventive control against banking trojans is preventing sideloaded applications on managed devices. Android allows sideloading by default; corporate-managed devices should disable it. iOS does not permit sideloading without special configurations, which provides structural protection that should not be undone for productivity convenience. For applications themselves, MDM-enforced application allowlists ensure that only approved business applications run on corporate-managed devices.

The Executive Mobile Hygiene Conversation

For senior executives whose individual mobile compromise would constitute a board-reportable security incident, the mobile threat conversation needs to happen at the individual level. Apple Lockdown Mode, Google Advanced Protection, hardware security keys for primary authentication factors, careful management of social media and biographical information that informs targeting, and clear protocols for unexpected calendar invites or messages — none of these controls are universally appropriate but each is appropriate for the executive subset of any modern enterprise.

What is Mobile Malware?