Mobile-first phishing attacks surge as specific capabilities are targeted

As organizations increasingly rely on mobile devices for business operations, including multi-factor authentication and mobile-first applications, mobile phishing poses a severe risk to enterprise security.

New research from Zimperium's zLabs shows a surge in mobile-focused attacks, dubbed 'mishing', activity peaking in August 2024 with over 1,000 daily attack records. These attacks are specifically designed to evade desktop security measures, executing only on mobile devices.

Three percent of phishing sites use device-specific redirection, showing benign content on desktops while targeting mobile devices with phishing payloads. This makes detection and analysis of the attacks more challenging.

"Mishing is not just an evolution of traditional mobile phishing tactics -- it is an entirely new category of attack engineered to exploit the specific capabilities and vulnerabilities of mobile devices, such as cameras," says Nico Chiaraviglio, chief scientist at Zimperium. "Our research shows that attackers are increasingly leveraging multiple mobile-specific channels -- including SMS, email, QR codes, and voice phishing (vishing) -- to exploit user behaviors and expand their attack surface."

See also:
Phishing-as-a-Service kits see a surge as threat actors target weaknesses
Deepfakes, workforce fraud and phishing incidents on the rise across businesses
SMEs put at risk by poor mobile security practices

Smishing (SMS/text based phishing) remains the most common mobile phishing vector, with 37 percent of attacks in India, 16 percent in the US, and nine percent in Brazil.

Quishing (QR code phishing) is an emerging threat, with notable activity in Japan (17 percent), the US (15 percent), and India (11 percent).

The research also shows attackers reusing CIDR (Classless Inter-Domain Routing) blocks to host multiple phishing domains, extending attack reach and persistence.

You can read more and get the full report on the Zimperium blog.

Image credit: Techa Tungateja/Dreamstime.com