Security researchers at Zscaler have uncovered a rise in financially-motivated mobile attacks, with a 111% growth in spyware and 29% growth in banking malware, as well as a 45% increase in IoT malware attacks. 

The annual ThreatLabz 2024 Mobile, IoT, & OT Threat Report, shows that mobile devices remain a top threat vector, with more than 200 malicious apps in the Google Play Store, accounting for over 8 million collective installs, being identified.

Of those apps, Joker was the most prevalent malware on the platform, making up almost two-fifths (38%) of harmful apps found by Zscaler. Joker facilitates Wireless Application Protocol (WAP) fraud by secretly enrolling victims in premium-rate services without their knowledge.

Adware ranked second, representing 35% of the malware detected, followed by Facestealer (14%), which aims to steal Facebook credentials to take over accounts.

The growth in banking malware attacks and spyware is evidence that cyber-attacks are proving ever more profitable for threat actors, either through monetary gain via direct extortion, or through the use of stolen personally identifiable information (PII) and user credentials that can be sold for leveraged in future attacks.

Anatsa, for example, is a known Android banking malware that uses PDF and QR code readers to distribute malware, and has been used to target more than 650 financial institutions and users in Germany, Spain, Finland, South Korea and Singapore.

ThreatLabz report, which compiles data from more than 20 billion threat-related mobile transactions and cyber-threats, found that the technology (18%), education (18%) and manufacturing (14%) sectors are the most frequent targets of mobile malware.

The education sector, in particular, saw a dramatic 136% increase in blocked transactions compared to last year.

For the second year in a row, manufacturing experienced the highest volume of IoT malware attacks, with 36% of all IoT malware blocks observed on the Zscaler platform, due in part to the increasing use of IoT devices within the manufacturing sector for purposes like automation and supply chain management.

ThreatLabz report also highlighted the threat posed by legacy and end-of-life operating systems which often run on OT equipment, and can’t be updated as the hardware is not compatible with newer systems.

“Cybercriminals are increasingly targeting legacy exposed assets which often act as a beachhead to IoT & OT environments, resulting in data breaches and ransomware attacks,” said Deepen Desai, chief security officer at Zscaler. 

“Mobile malware and AI driven vishing attacks adds to that list making it critical for CISOs and CIOs to prioritize an AI powered zero trust solution to shut down attack vectors of all kinds safeguarding against these attacks.”

Recommended reading

• Global Mobile Banking Malware Grows 32%
• Security Vendor Finds Malware Hidden in YouTube Descriptions
• Is Google Promoting Malware in Search?

The threat of mobile malware is growing as cyber-criminals find more ways to target vulnerabilities in mobile banking and other financial services apps. 

Earlier this year, a study by Kaspersky also found significant increases in mobile banking malware and cryptocurrency-related phishing, and claimed that the previous 12 months had witnessed a substantial rise in the number of users encountering mobile banking Trojans, with attacks on Android users surging by 32%.