In a world where mobile devices are a critical part of our daily lives, it’s shocking to learn that over 200 malicious apps were recently discovered on the Google Play Store, collectively downloaded 8 million times. If you’re like most users, you trust that the apps you download from the Play Store are safe. But as Zscaler ThreatLabz’s 2024 Mobile, IoT, & OT Threat Report highlights, this trust may be misplaced. These malicious apps, often disguised as useful tools like PDF readers and QR code scanners, are designed to steal sensitive information and bypass security measures.
According to the ThreatLabz report, spyware and banking malware are on the rise, with spyware attacks growing by 111% year-over-year. As attackers target mobile devices with increasing precision, the implications are staggering: your phone could be at risk right now. You can read the full report and analysis from Zscaler here.
Let’s explore the findings from the ThreatLabz report, the nature of these threats, and what you can do to ensure your phone isn’t compromised.
Table of Contents
Malicious Apps on Google Play Store: A Trojan Horse in Your Pocket
The discovery of over 200 malicious apps on the Google Play Store highlights how easily attackers can bypass security checks. Once installed, these apps can gain access to your personal data, bank accounts, and even your login credentials for sensitive services.
But what makes these attacks especially dangerous? Anatsa, Vultur, and Hydra are just a few names of banking malware that have been spreading across the Play Store. These sophisticated trojans target banking apps, stealing credentials and personal data to empty bank accounts or commit financial fraud.
The Trojan-Dominated Threat Landscape
According to the ThreatLabz report, 46.9% of mobile threats in 2024 were Android trojans. Banking malware, in particular, is a trojan-dominated threat, with attackers using sneaky tactics to steal user credentials and bypass multifactor authentication (MFA). Malware families like Hydra, first discovered in 2019, can hijack login processes, invisibly stealing credentials when you use banking apps.
And it’s not just your bank accounts at risk. Facestealer, another prominent malware family, specializes in harvesting Facebook credentials, putting your social media accounts—and potentially the personal data of your friends and family—at risk as well.
Why Are Mobile Devices Such Prime Targets?
As mobile devices have become essential for both work and personal life, they present an irresistible target for cybercriminals. Today, 96.5% of internet users access the web via mobile devices, and with more than 70% of those devices running Android, attackers have a large, highly vulnerable market to exploit.
Android’s market dominance, combined with the bring-your-own-device (BYOD) trend in workplaces, creates a security nightmare. Mobile devices are no longer just phones—they’re gateways to sensitive work systems, bank accounts, and personal data. Whether it’s through apps you trust or mobile phishing scams, attackers are constantly finding new ways to compromise mobile security.
The Rise of Spyware: Your Data at Risk
While the overall volume of mobile attacks has slightly declined, the sophistication of these attacks has increased significantly. The Zscaler ThreatLabz report indicates that spyware attacks have surged by 111%, with attackers focused on long-term data collection. Spyware like SpyNote and SpinOk silently record your activities, monitor your communications, and even take control of your device.
These apps often disguise themselves as helpful utilities, much like their banking malware counterparts, but once installed, they exploit permissions to spy on every action taken on your phone. Some spyware can activate your camera or microphone, track your location, or steal files and photos from your device—without you ever knowing.
One particularly devious tactic used by these apps is their abuse of Android’s Accessibility Service, which was originally designed to help users with disabilities. Unfortunately, when this service is abused, it allows the malware to gain deep control over your device, locking you out of settings, capturing keystrokes, or even uninstalling your antivirus software.
QR Code Scams and Mobile Phishing
The explosion of QR code scams adds yet another layer of risk. Attackers embed malicious URLs in QR codes that, when scanned, lead users to phishing sites that steal their login credentials. The ThreatLabz report details a case where a QR code was used to mimic the US Postal Service website, tricking users into entering their credit card information to pay for a fictitious delivery.
Mobile devices are particularly susceptible to phishing attacks during holiday shopping seasons, when users are more likely to click on links from brands they trust. Attackers exploit this by setting up fake login pages that look like they belong to popular financial institutions, retail stores, or even social media platforms.
IoT and OT Devices: A Growing Attack Surface
While mobile malware gets most of the attention, the Zscaler ThreatLabz report also highlights a worrying trend: the rise in attacks targeting Internet of Things (IoT) and Operational Technology (OT) systems. From smart home devices to industrial control systems, these environments are increasingly being integrated with enterprise networks, creating an enormous attack surface that is difficult to protect.
In 2024, 45% more IoT malware transactions were recorded, with botnets like Mirai and Gafgyt continuing to dominate the threat landscape. These botnets often exploit insecure devices like routers and set-top boxes, using them to launch distributed denial-of-service (DDoS) attacks.
Vulnerable Devices: Routers and Set-Top Boxes
Routers accounted for 66% of all IoT malware attacks, making them the top target. These devices are essential for internet connectivity, yet they often lack robust security measures, leaving them vulnerable to exploitation.
Take the Mirai botnet, for example. By infecting millions of IoT devices worldwide, including routers, set-top boxes, and even smart TVs, Mirai can unleash devastating DDoS attacks. In 2023, a variant of Mirai, known as Pandora, targeted Android-based TV sets, underscoring the increasingly diverse range of IoT devices under threat.
Protecting Yourself and Your Organization
So, how can you protect yourself from falling victim to these increasingly sophisticated threats? Whether you’re an individual user or managing security for an organization, there are several best practices to follow to minimize risks. Let’s break them down, providing practical steps and technical recommendations.
1. Only download apps from trusted sources
Cybercriminals often hide malware in apps that look harmless, such as productivity tools or entertainment apps, on official platforms like the Google Play Store. Over 200 malicious apps were found on the Play Store in 2024 alone, disguised as QR code scanners, file managers, and more. Always verify an app’s developer information, reviews, and permissions before downloading, and regularly check your device for suspicious apps.
For more information on how apps like these infiltrate Google Play, you can refer to Zscaler’s ThreatLabz Report.
2. Regularly update your device’s software
Mobile operating systems frequently release updates to patch known security vulnerabilities. Unpatched software is a prime target for attackers using malware such as Anatsa or Hydra, which exploit weaknesses in outdated systems. Enable automatic updates to ensure your mobile OS and applications remain protected from the latest threats.
In Operational Technology (OT) environments, legacy systems are common and vulnerable. Zscaler’s research found that 50% of OT systems rely on legacy operating systems, which often have well-known, unpatched vulnerabilities. Regular updates and proactive patch management are critical for safeguarding both mobile devices and OT systems.
3. Enable multi-factor authentication (MFA)
While some malware campaigns, such as banking trojans, can attempt to bypass MFA, it remains one of the most effective defenses against unauthorized access. MFA requires users to provide two or more verification methods—such as a password and a one-time code sent to your phone—making it much harder for attackers to gain access even if they’ve stolen login credentials. To mitigate MFA bypass attacks, ensure that you use phishing-resistant MFA, such as FIDO2 or biometrics, which attackers cannot easily spoof.
4. Inspect QR codes and links
QR codes are often used in phishing campaigns to trick users into visiting malicious websites. As described in ThreatLabz’s 2024 report, threat actors have been embedding malicious URLs in QR codes, which direct victims to fake websites to steal their credentials or deploy malware. Always double-check the URL behind a QR code before entering any sensitive information.
In one phishing campaign, attackers mimicked the US Postal Service (USPS), tricking users into entering payment details to cover a fictitious delivery fee. Scams like these are widespread, especially during high-traffic seasons like holidays.
5. Segment your IoT and OT networks
In IoT and OT environments, network segmentation is essential for minimizing the spread of malware. According to ThreatLabz, routers account for 66% of all IoT malware attacks, often because they are poorly segmented from other parts of the network. By isolating IoT and OT devices into smaller network zones, you limit lateral movement, which prevents a single compromised device from infecting the entire system.
Segmenting devices also helps reduce the risk in OT environments, where 67% of internal OT connections are classified as unauthorized or unnecessary. Ensuring proper segmentation for both internal and external connections is crucial to limiting the potential damage from a breach.
6. Monitor encrypted traffic
Encrypted traffic, which often goes unmonitored, is a favorite tool for cybercriminals to hide malware. As encrypted channels become more common, attackers use these secure tunnels to bypass traditional security systems. According to Zscaler ThreatLabz, inspecting all encrypted traffic—especially on IoT devices—is essential. Without this inspection, 45% of IoT malware transactions would go unnoticed.
By employing deep packet inspection (DPI) or other advanced monitoring tools, organizations can ensure they are not blind to encrypted malware payloads that could compromise their network.
FAQs
What are the risks of downloading apps from the Google Play Store?
Downloading apps from the Google Play Store comes with certain risks, particularly as malicious apps can sometimes bypass Google’s security checks. As detailed in the Zscaler ThreatLabz 2024 Mobile, IoT, & OT Threat Report, over 200 malicious apps were discovered on the Google Play Store, some of which had been downloaded millions of times. These apps often disguise themselves as harmless tools like PDF readers or QR code scanners, but in reality, they are designed to steal personal data, banking credentials, or compromise the security of your device.
How can I protect my phone from mobile malware?
To protect your phone from mobile malware:
- Download apps only from trusted developers and verify app reviews.
- Regularly update your device’s operating system and apps to ensure any security patches are applied.
- Enable multi-factor authentication (MFA) to add an extra layer of security.
- Use a reputable mobile security solution to scan for potential threats.
- Be cautious when granting apps permissions, particularly for sensitive features like SMS or accessibility services.
For more on preventing mobile malware, you can refer to the Zscaler ThreatLabz report on rising mobile threats.
What is mobile spyware, and how does it affect my device?
Mobile spyware, such as SpyNote and SpinOk, are malicious programs that secretly monitor your device’s activities, steal personal information, and may even take control of your phone. As described in the Zscaler ThreatLabz report, mobile spyware attacks have risen by 111% in the past year. Spyware can capture keystrokes, access your camera and microphone, track your location, or steal files and data from your device, all without your knowledge.
How does QR code phishing work?
In QR code phishing schemes, attackers embed malicious URLs within a QR code, which, when scanned, directs users to fraudulent websites designed to steal personal data or login credentials. According to the Zscaler report, these phishing schemes often target mobile devices during holiday shopping seasons, making it crucial to scrutinize QR codes carefully before scanning.
What is Anatsa malware, and how does it target banking apps?
Anatsa, also known as TeaBot, is a highly sophisticated Android banking malware. It targets users through dropper apps in the Google Play Store, which appear as legitimate tools like PDF or QR code readers. Once downloaded, these apps execute a staged payload that intercepts banking credentials. Anatsa is known to target over 650 financial institutions worldwide. You can find a detailed technical analysis of Anatsa in the Zscaler ThreatLabz report.
How do IoT devices become vulnerable to cyberattacks?
IoT devices are vulnerable to cyberattacks because they often lack robust security features and are connected to both home and enterprise networks. Attackers target IoT devices like routers and set-top boxes, using them to form botnets for distributed denial-of-service (DDoS) attacks. According to the ThreatLabz 2024 report, IoT malware attacks increased by 45% year-over-year, with most attacks targeting routers. Ensuring proper network segmentation and regular firmware updates is crucial for IoT security.
What is the best way to secure IoT and OT networks?
The best way to secure IoT and OT networks is by adopting a zero trust architecture, which assumes that no device or user is trustworthy by default. This involves:
- Segmenting networks to limit the spread of malware.
- Monitoring encrypted traffic to detect hidden threats.
- Regularly updating devices to patch vulnerabilities.
- Implementing multi-factor authentication and strict access controls for critical systems.
These strategies, outlined in the Zscaler ThreatLabz report, are essential for defending against IoT and OT threats.
Conclusion: Don’t Let Your Guard Down
The discovery of over 200 malicious apps in the Google Play Store, combined with the rise in sophisticated mobile, IoT, and OT threats, should serve as a wake-up call. Mobile devices are a central part of our lives, and attackers are constantly developing new ways to exploit them.
By staying informed and taking proactive measures—such as keeping devices updated, using MFA, and being vigilant with app downloads—you can significantly reduce your risk. And for organizations, adopting a zero trust architecture and segmenting networks are critical steps to protect against this growing attack surface.
With the frequency and sophistication of mobile threats increasing every year, the question is no longer if your phone will be targeted, but when.
