What is mobile malware and how do you protect your phones?

Mobile malware is malicious software that runs on a phone or tablet to steal data, spy on the user or take over accounts. It usually arrives through a malicious app, a phishing message or an unpatched flaw. Defend with updates, app controls, device management and strong sign-in.

Why are phones a target?

NIST SP 800-124 Revision 2 puts it this way: mobile devices began as personal consumer communication tools, and are now permanent fixtures in enterprises, used to reach modern networks and systems that process sensitive data. A phone holds email, authenticator apps, banking, photos, location and work chat. Taking over one phone can give an attacker access to most of a person's accounts.

NIST's guide covers mobile devices, centralized device management and endpoint protection, for both organization-owned and personally owned deployments. That last part matters. The device a worker uses for a second factor is often their own.

How does it arrive?

Common routes, in the order teams tend to meet them:

• Phishing by text or messaging apps. A link leads to a fake login page or a prompt to install something.
• Apps outside official stores, or look-alike apps. A copy of a popular app carries extra, hidden behavior. Installing from unofficial sources gets around store checks.
• Over-broad permissions. A flashlight app that asks for access to messages and accessibility services has no good reason to do so. Accessibility permissions are particularly powerful, because they let an app read the screen and act for the user.
• Unpatched operating systems. A known flaw stays open when updates are delayed or when a device is too old to get them.
• Targeted attacks. CISA's mobile guidance, updated in March 2026, was written in response to espionage activity by nation-state affiliated actors against telecommunications infrastructure and efforts to compromise encrypted communications. It focuses on highly targeted people such as senior officials, but its advice on updating, strong authentication and careful messaging habits is a useful baseline for anyone.

What does it do once installed?

Typical goals are stealing credentials and one-time codes, reading messages, recording the screen, showing fake overlays over banking apps, subscribing the user to paid services or giving an attacker remote access. The first sign is often small: unexplained battery drain, apps you do not remember installing or a security alert from a bank.

A constructed example: an employee gets a text about a parcel delivery and installs an app to track it from a link. The app asks for accessibility permission, which they grant. It then watches for the company's authenticator app and reads the one-time codes shown on screen. The attacker logs in to email with the stolen password and the live code. Phishing-resistant sign-in methods that do not show a code to copy would have blunted this.

What does the app side look like?

If you build mobile apps, the OWASP Mobile Application Security Verification Standard (MASVS) groups requirements into areas: storage, cryptography, authentication and authorization, network communication, platform interaction, code quality, resilience against reverse engineering and privacy. These matter to malware because your app may be the thing a malicious app tries to read from, overlay or imitate. Store secrets properly, protect data on the device and verify what your app trusts.

How to check or apply this

1. Turn on automatic operating system and app updates, and retire devices that no longer receive them.
2. Install apps only from official stores. For work devices, restrict to an approved list through device management.
3. Review permissions on each device. Remove accessibility, device administrator and notification access from apps that do not need it.
4. Use a device management or endpoint protection tool for work phones, as NIST's guide describes, with the ability to wipe a lost or compromised device.
5. Prefer passkeys or hardware security keys over codes that can be read from a screen or intercepted.
6. Teach staff to treat links in unexpected texts as hostile, and give them a place to report one.
7. For apps you build, check your work against MASVS areas and fix storage and network gaps first.

Quick check

Sources

• NIST SP 800-124 Rev. 2, Guidelines for Managing the Security of Mobile Devices in the Enterprise
• CISA, Mobile Communications Best Practice Guidance
• OWASP MASVS

Last reviewed: 18 October 2026.