SetupAI
繁
SourceStalecollected in 11m

Mobile phishing is now a greater threat than email

Read original on ZDNet AI
#cybersecurity#phishing#mobile-security

Critical security shift: Mobile phishing is outpacing email, requiring new AI-driven detection strategies.

30-Second TL;DR

What Changed

Shift from email-based to mobile-based phishing attacks

Why It Matters

Organizations must update their security training to include mobile-specific phishing vectors. AI-driven security tools should prioritize monitoring SMS and voice traffic patterns.

What To Do Next

Implement AI-based SMS filtering and anomaly detection for mobile communication channels in your enterprise security stack.

Who should care:Enterprise & Security Teams

Key Points

  • •Shift from email-based to mobile-based phishing attacks
  • •Verizon DBIR data highlights rising SMS and voice call threats
  • •Email security improvements are forcing attackers to adapt
Key numbers40%62%16%6%

Deep Insight

Background and context from public sources — not the original article. 16 sources cited.

Enhanced Key Takeaways

  • •The 2026 Verizon Data Breach Investigations Report (DBIR) indicates that mobile-centric social engineering attacks, specifically via SMS and voice calls, exhibit a 40% higher success rate compared to traditional email phishing attempts.
  • •The heightened vulnerability to mobile phishing is partly attributed to the smaller screen sizes of mobile devices, which can obscure malicious URLs and make it more challenging for users to discern fake websites, alongside the growing prevalence of Bring Your Own Device (BYOD) policies in hybrid work environments.
  • •Mobile phishing attacks extend beyond SMS and voice calls, leveraging various channels such as messaging applications and embedded URLs within other apps, thereby circumventing many conventional email security defenses.
  • •The 'human element' played a role in 62% of all breaches, with social engineering, including mobile phishing, ranking as the third most common breach pattern, accounting for 16% of all breaches analyzed in the 2026 DBIR.
  • •Pretexting, a social engineering tactic where attackers establish a fabricated scenario to build trust before manipulating victims, has emerged as a more frequent initial access vector for ransomware and extortion attacks, contributing to 6% of all breaches.

Competitor Analysis

Core Focus
Lookout Mobile Security
Comprehensive mobile endpoint security, phishing, smishing, executive impersonation
Check Point Mobile Security
Malware, phishing, OS vulnerabilities, compromised devices, zero-day threats
CrowdStrike Falcon
AI-first, real-time processing, behavioral analytics, EDR for mobile
Zimperium Mobile Threat Defense (MTD)
Mobile phishing (mishing) detection & prevention across all channels
SentinelOne Singularity Mobile
On-device, adaptive, real-time defense, threat detection & response
Ivanti Neurons for MTD
Advanced threat intelligence, network/device/app threat protection
Phishing Detection
Lookout Mobile Security
Detects, blocks, prevents phishing via email, web, SMS, messaging apps; network-level URL inspection without content inspection
Check Point Mobile Security
Protects against malware, phishing attempts, zero-day phishing
CrowdStrike Falcon
AI-first solution, real-time processing, behavioral analytics to detect suspicious behavior
Zimperium Mobile Threat Defense (MTD)
Identifies mobile phishing (mishing) with 99.99% accuracy, including zero-day attacks, across email, SMS, QR codes, in-app messaging
SentinelOne Singularity Mobile
Extends Singularity platform for endpoint threat detection and response
Ivanti Neurons for MTD
Leverages AI to detect and block zero-day phishing and malicious web threats
Threat Intelligence
Lookout Mobile Security
Lookout Security Cloud, global sensor network from 180M+ devices, 100M+ apps
Check Point Mobile Security
ThreatCloud intelligence, cloud-based sandboxing
CrowdStrike Falcon
Real-time processing, data across devices, workloads, cloud, user identities
Zimperium Mobile Threat Defense (MTD)
Holistic approach to detection, focused solely on mobile device protection
SentinelOne Singularity Mobile
Platform-wide threat network for uncommon threats
Ivanti Neurons for MTD
Advanced Threat Intelligence
Privacy-focused
Lookout Mobile Security
Inspects outbound connections at network level, does not rely on inspecting message content
Check Point Mobile Security
Not explicitly detailed in sources
CrowdStrike Falcon
Not explicitly detailed in sources
Zimperium Mobile Threat Defense (MTD)
Ensures user privacy
SentinelOne Singularity Mobile
Not explicitly detailed in sources
Ivanti Neurons for MTD
Not explicitly detailed in sources
Deployment/Management
Lookout Mobile Security
Integrates with broader EDR/SIEM systems, offers free assessment
Check Point Mobile Security
Unified cloud-based console, MDM/UEM integration
CrowdStrike Falcon
Reduces alert response time
Zimperium Mobile Threat Defense (MTD)
Protects iOS, Android, Chromebook devices
SentinelOne Singularity Mobile
Part of SentinelOne's Singularity platform
Ivanti Neurons for MTD
Integrates with Ivanti Neurons for MDM, supports corporate and BYO devices
Key Differentiator
Lookout Mobile Security
Predictive machine intelligence, securing mobility since 2007
Check Point Mobile Security
Prevention-first approach, secures every mobile attack surface
CrowdStrike Falcon
Speed and lightweight on-device performance
Zimperium Mobile Threat Defense (MTD)
Focused solely on mobile device protection, blocks attacks from various vectors
SentinelOne Singularity Mobile
Adaptive, real-time defense, effective for uncommon threats
Ivanti Neurons for MTD
Comprehensive MDM and security, effortless 100% user adoption

Technical Deep Dive

  • Smishing (SMS Phishing) Mechanics: Attackers craft fraudulent SMS messages designed to mimic legitimate entities (e.g., banks, delivery services, government agencies). These messages often contain malicious links that, when clicked, direct users to fake websites designed to harvest credentials or install malware like ransomware, adware, or spyware. The smaller screens of mobile devices make it harder for users to scrutinize URLs and identify fake sites.
  • Vishing (Voice Phishing) Mechanics: Vishing attacks involve phone calls, often using automated voice messages or live callers impersonating trusted organizations (e.g., tech support, banks). Attackers employ social engineering tactics to create urgency or fear, compelling victims to divulge sensitive personal or financial information or authorize fraudulent transactions over the phone. More sophisticated attacks may involve multiple calls to build trust.
  • Mobile Phishing Protection Technologies: Solutions like Lookout Mobile Phishing Protection operate by inspecting all outbound connections made by a mobile device and its installed applications at the network level. This approach correlates accessed URLs against a database of known malicious URLs identified by a security cloud, alerting the user before a connection to a risky site is completed, without needing to inspect message content, thus preserving user privacy.
  • AI and Behavioral Analytics in Defense: Modern mobile security platforms are increasingly adopting AI-first approaches. These systems leverage AI to detect and block zero-day phishing and malicious web threats. They also employ real-time processing and behavioral analytics to monitor user actions and network activity, identifying anomalous behavior that could indicate a phishing attempt or a compromised device.
  • Exploitation of Mobile UI/UX: Mobile operating systems and browsers often lack robust, secure application identity indicators. This constraint, combined with smaller screen real estate, makes it difficult for users to definitively determine the legitimacy of an application or website they are interacting with, increasing the risk of mistaking a malicious entity for a trusted one.

Future ImplicationsAI analysis grounded in cited sources

Mobile security solutions will increasingly integrate AI and behavioral analytics.
The evolving sophistication of mobile phishing and the higher success rates of social engineering on mobile devices necessitate more advanced, adaptive detection and prevention mechanisms beyond traditional signature-based methods.
Employee training on mobile-specific social engineering tactics will become a critical component of enterprise cybersecurity strategies.
As attackers bypass automated email defenses, the responsibility for identifying smishing and vishing largely falls on human judgment, making comprehensive training essential.
Regulatory bodies may introduce new guidelines or standards specifically addressing mobile device security and phishing prevention.
The increasing risk of data breaches originating from mobile phishing, coupled with the widespread use of personal devices for work, will likely prompt greater scrutiny and demand for standardized protections.

Timeline

1996
The term 'phishing' is coined by the group AOHell, targeting America Online (AOL) users.
2001
Phishing attacks evolve with the rise of e-commerce, using spoofed websites impersonating popular domains like eBay and PayPal.
2004
Techniques like spear phishing, smishing, and keylogging are developed.
2013
Phishing becomes the primary technique to deliver ransomware, with Cryptolocker being a notable early instance.
2022
Lookout data records the highest percentage of mobile phishing encounter rates ever, with over 30% of personal and enterprise users exposed quarterly.
2025
Data for the 2026 Verizon DBIR collected (Nov 1, 2024 - Oct 31, 2025), highlighting mobile-centric social engineering attacks with a 40% higher success rate than email phishing.
Read original article on ZDNet AI

Weekly AI Recap

Read this week's curated digest of top AI events →

PostLinkedIn

AI-curated news aggregator. All content rights belong to original publishers.
Original source: ZDNet AI ↗

This is a summary, not the original. Read the source, or get the weekly briefing.

The weekly digest

One email a week. Unsubscribe anytime.