Mobile Threat Landscape Report:
Q1 2024

Executive Summary

Phishing and Malicious Web Content

Mobile phishing and malicious content have exploded in popularity as attackers evolve their tactics to target enterprise credentials. This has led to a fundamental shift in the traditional cyber killchain, and this modern killchain is dependent on using legitimate credentials as a way to quietly enter corporate infrastructure and compromise data. Attackers take on convincing personas as internal IT or security teams to trick employees into sharing or supposedly resetting their passwords.

As one of the most widely-adopted mobile threat defense solutions, Lookout defends its customers with out-of-the-box protections against phishing and malicious content as well as the ability to create custom content rules and denylists.

17,750,000

Denylisted and offensive content sites blocked in Q1 of 2024. This is up from 4,545,000 in Q1 of 2023.

900,000

Phishing and malicious web attacks were prevented by Lookout in Q1 of 2024. This is up from 455,000 in Q1 of 2023.

18,650,000

Sites blocked by Lookout in Q1 of 2024

Mobile Vulnerabilities

Vulnerabilities exist at both the operating system (OS) and app level on mobile devices. While OS and app developers will frequently push updates to patch these vulnerabilities, it’s the job of the end user to actually install them. The gap between when a developer releases a patch and when the new version is installed creates an opportunity for attackers to exploit the vulnerable device and compromise it.  

Lookout monitors a wide range of vulnerabilities and threats, their global presence, and their potential impacts to inform you at the earliest possible moment and keep you safe. Below are the top vulnerabilities encountered by Lookout users in the first quarter of 2024. 

The most common app vulnerabilities in Q1 were all in components of mobile browsers. Attackers most commonly exploit these vulnerabilities with maliciously crafted webpages, which can be delivered as a link to the target device. From the attacker’s perspective, knowing that almost every mobile device runs either Chrome, Firefox, Safari, or Edge as their default browser means they can target potentially vulnerable devices with these malicious links and hope that the user hasn’t updated their app to a patched version. 

iOS Vulnerabilities

Almost every iOS update we’re asked to install on our smartphones has to do with a security vulnerability. In fact, there have already been more than 120 iOS vulnerabilities published in 2024. Apple supports the latest version of the two most recent major iOS versions from a security standpoint. At the time of this report being written, iOS 16.7.8 and iOS 17.5 are the latest versions. In the graph below, anything other than those two versions is considered out of date, which means any device on those versions is likely to be vulnerable.

Mobile Malware

Mobile app threats and malware can range from invasive permissions and riskware that create a massive compliance risk to advanced spyware that can track devices, steal data off of the device, listen in on conversations, and use the device’s camera. Regardless of the severity of the malware, understanding where your users, devices, and data are at risk on mobile is a critical piece of the modern day security posture.

Empower Your Security Team with Threat Intelligence

As an extended service, Lookout provides advanced Threat Intelligence to organizations that aim to enhance in-house detective or protective systems.

New mobile malware families protected against in Q1: 39

Known mobile malware families given enhanced protection in Q1: 85

Most critical threat families of Q1 2024

Device Risks

In addition to phishing, apps, and malware, there are misconfigurations that can occur and open up the entire device to being taken over. This can range from simple device settings to advanced malware that gains root admin access to the device. 

The risks posed by security misconfiguration vulnerabilities can have serious consequences for users. Security misconfigurations can leave a device and the data on it vulnerable to known and unknown exploits.

Jailbreaking & rooting a device can weaken a device's built-in security features, leave it vulnerable to malware and exploits and, if done incorrectly, can render the phone useless. A user might intentionally jailbreak their device for a variety of reasons, but device compromises can also be initiated remotely by advanced threat actors who want to silently turn a mobile device into a surveillance tool. This type of behavior has been observed in APT activity tied to cyberespionage and nation-state backed attacks, and is most infamously tied to the way NSO Group’s Pegasus surveillanceware infects a targeted individual’s device.