4 MIN READ
Picture the typical enterprise security program in 2026. Endpoint, network, cloud, identity. The four pillars the CISO has been told to fund, and the four pillars the security org has been told to defend. Mobile sits outside every one of them, not in a strategic “we will get to it” way, but in a “we have not actually looked” way.
The mobile app is the app the employee uses for the work, the app the customer uses for the purchase, the app the partner uses for the integration. Credentials, payment data, corporate chat, production database access, all of it sits on a device the security program is not watching. The blind spot is not new. The scope of what lives in the blind spot has grown year on year, and the security program has not caught up.
The four categories that do the damage
Most published telemetry puts credential stealers in the lead. The malware ships as a productivity tool, a banking helper, a QR scanner, something boring enough to land in the store and the user installs it without thinking. From there the malware watches keystrokes, scrapes the screen when the user signs into the work account, forwards the captured session token to a server the operator controls. Industry tallies put this category at roughly half of the mobile malware seen in the wild, and the share has been climbing.
Data exfiltrators run second. The model is older and simpler. Pull the contact list, the message database, the photo library, anything with resale value on the underground market. Ransomware is third, and it looks like the desktop variant. Encrypt the device, demand the payment, threaten the deletion. The per-device damage tends to be smaller because most users have a recent cloud backup, but the disruption is real for any individual who lives mostly on the phone. Adware fills out the list, fraud click inflation and notification spam, lower stakes per device but the install base is large enough to make it worthwhile.
How the malware actually gets onto the device
Three routes cover most infections, and the official store is the surprise. The malware gets past the App Store or Google Play review, almost always by being a clean app at submission and only pulling the malicious payload in an update weeks later. The model works because the store review only sees the version that ships, and the version that updates is a different file.
Third party stores and sideloaded APKs are the second route, more common in the consumer install base outside the West than inside it, but growing inside the West as users chase free alternatives to paid apps. The supply chain is the third, and it is the most damaging. A developer tool, an SDK, an advertising library gets compromised, and the malicious code ships inside an app the brand already trusts and the user already has installed. The same shape as the SolarWinds and 3CX compromises, just on a smaller scale and aimed at consumers instead of enterprises.
What real defence looks like
Mobile threat defence sits as the first piece. Software on the device that watches for known malware families and risky configurations, the modern equivalent of endpoint protection but built for a phone. Mobile Application Management comes next, the corporate IT function wrapping the work apps in a managed container they can wipe if the device is lost or the employee leaves. App vetting closes the list, a process where the security org actually inspects the apps the workforce is installing, not just the ones the company ships.
None of the three covers the gap on its own. The platform team that runs only MTD still loses the work data when the device goes missing. The IT function that runs only MAM still loses the device to a malware family the vendor has not seen before. The security org that runs only app vetting still misses the supply chain compromise that arrives inside a trusted update. The combination is the point, and the combination is what the typical security program is missing.
The bottom line
Mobile threat defence, managed app wrapping, real app vetting. The security program that treats mobile as the same surface as the laptop is the one that has a chance at the breach that comes in through the phone.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
