Zimperium, the only mobile-first security platform for mobile devices and apps, today released its highly anticipated global mobile threat report 2023.
The report reveals a continued growth towards mobile-powered business along with the increasingly sophisticated security risks facing it, including spyware, phishing and ransomware.
The report examines the most important trends that shaped the mobile security landscape over the past year and draws on the research from Zimperium’s zLabs researchers, as well as third-party industry data, partner insights, and observations from leading industry influencers.
Key among the findings is that 43% of all compromised devices were fully exploited (not jailbroken or rooted), an increase of 187% year-over-year.
“The explosive growth in mobile device and app usage has created an ever-growing attack surface,” said Shridhar Mittal, CEO of Zimperium. “Mobile devices are integral to the way we work, communicate, navigate, bank, and stay informed - creating new opportunities for malware.
“Last year’s global mobile threat report revealed that 60% of the endpoints accessing enterprise assets were mobile devices, and this does not seem to be slowing down. Mobile-powered businesses must increase mobile security measures to protect the personal data security of employees and the sensitive information belonging to the organisation.”
The mobile-powered initiatives of today’s enterprises and government agencies are under attack. The latest Zimperium research drives home the sobering reality that the rise in mobile-powered businesses is opening the door to vulnerability gaps that are being specifically targeted by cybercriminals and nation-states.
Key Findings
- Phishing attacks against mobile devices are growing. 80% of phishing sites target mobile devices specifically or are designed to function both on desktop and mobile. Meanwhile, the average user is six to ten times more likely to fall for SMS phishing attacks than email-based attacks.
- During 2022, Zimperium detected an average of four malicious/phishing links clicked for every device covered with its anti-phishing technology.
- EMEA and North America have the highest percentage of devices being impacted by spyware, with EMEA at 35% and North America at 25%.
- Both Apple and Android saw increasing instances of detected vulnerabilities. There was a 138% increase in critical Android vulnerabilities discovered in 2022, while Apple iOS accounted for 80% of the zero-day vulnerabilities actively being exploited in the wild.
- Malware is continuing to proliferate rapidly. Between 2021 and 2022, the total number of unique mobile malware samples rose 51%, with more than 920,000 samples detected, including Dirty RatMilad, MoneyMonger and Dark Herring. Zimperium protected its customers from 2,000 samples each week that were not yet identified by the industry in general (“zero-day” malware).
- In 2021, Zimperium detected malware on 1 out of 50 Android devices. It increased significantly in 2022 to 1 out of every 20 devices.
- Improper cloud storage configurations in mobile apps are a leading attack surface. Our analysis concluded that ±2% of all iOS and ±10% of all Android mobile apps accessed insecure cloud instances.
“There is a fundamental issue that today’s modern organisations must contend with how can they capitalise on the opportunities of being mobile powered without being exposed to evolving risks,” said Jon Paterson, CTO of Zimperium.
“To thrive, it is critical that they employ a mobile-first security strategy–one where they continually prioritise and assess risk as close to the user and device as possible, and baseline and continuously assess vulnerability posture to operate in a known state with complete visibility.
“They must take responsive action on risk detection: leverage zero trust and conditional access workflows, leverage XDR and autonomous, third party integrations and ensure they assess and stay updated on global privacy regulations and the risks that affect apps they develop and use.”
“We hear it from our customers all the time: unmanaged BYOD devices expand the attack surface, introduce critical cybersecurity vulnerabilities, and are a necessity in the work-from-anywhere economy,” said RSA chief product officer Jim Taylor, who detailed how these trends led to the development of RSA® Mobile Lock in Zimperium’s report.
“The global mobile threat report reveals why mobile security is becoming an urgent need for organizations, and why security-first leaders rely on Zimperium and RSA to help them address this emerging threat.”
"It is clear that mobile threats are becoming more frequent and dangerous, as bad actors increasingly target smartphones as high-value targets," says Phil Hochmuth, program VP, enterprise mobility at IDC. "This should be a wake up call for enterprises to increase focus and investment in mobile security tools and practices."
To read the full findings from the report and to see how a mobile-first security strategy is essential to any organisation looking to succeed in today’s cyber landscape, visit the link here.
To learn more about how Zimperium’s Mobile-First Security Platform can help organisations strengthen their mobile security posture, click here.
About Zimperium
Zimperium enables companies to realize the full potential of mobile-powered business by activating a Mobile-First Security Strategy. Built for the demands of mobile business, Zimperium’s Mobile-First Security Platform™ delivers unmatched security across both applications and devices. Only Zimperium delivers autonomous mobile security that dynamically adapts to changing environments so companies can capitalise on the new world of mobile-powered opportunities, securely. Zimperium is headquartered in Dallas, Texas and backed by Liberty Strategic Capital and SoftBank. For more information, follow Zimperium on Twitter (@Zimperium) and LinkedIn, or visit www.Zimperium.com .
