Forty per cent of IoT attacks are targeting critical industries and hybrid work as threat actors continue to evolve their tactics and hit larger targets, according to research from Zscaler.

The security firm’s newest ThreatLabz 2025 threat report outlines how threat actors are leveraging malware attacks and constantly evolving their tactics.

The report recovered hundreds of malicious apps in the Google Play Store that have been downloaded over 40 million times, targeting users that are searching for productivity and workflow apps.

Based on Zscaler’s mobile telemetry dataset, the ThreatLabz team identified several emerging mobile threats and new malicious activity, providing valuable insights to help enterprises stay ahead of attackers in a mobile-first world.

Malicious Apps

Similar to last year, this year saw threat actors again developing and releasing malicious applications targeting trusted marketplaces and hybrid work environments.

The result, which the report reveals is a 67% year-over-year increase in Android malware transactions, reflects the continues risks of spyware and banking malware.

ThreatLabz researchers identified 239 such applications hosted on the Google Play Store, which were collectively downloaded 42 million times.

A key distribution channel for this malware was the “Tools” category, disguising malicious applications as productivity and workflow tools. This tactic capitalises on users’ trust in functionality-driven application – a trust that is particularly strong in hybrid and remote work settings where mobile devices are integral to professional tasks.

Recommended reading

• Survey: Fear of Mobile App Security Neglect Rises by 258%
• Orgs are Overconfident When it Comes to Mobile App Security
• Report: For British Consumers, Mobile App Security Is Important

Top IoT Targets

Manufacturing and Energy sectors remain prime targets for cybercriminals due to the potential for significant returns, the research revealed.

Notably, the energy sector experienced a substantial 387% increase in attacks compared to the previous year, highlighting an escalating threat to critical infrastructure and greater exploitation of vulnerabilities within these essential industries.

In the IoT landscape, the Manufacturing and Transportation sectors continue to be the most frequently targeted verticals. This year, each  sector accounted for 20.2% of all observed IoT malware attacks, collectively representing over 40% of total incidents.

This marks a shift from 2024, when Manufacturing alone represented 36% of total incidents, followed by Transportation at 14%. This suggests that while Manufacturing remains a critical target, threat actors are increasingly diversifying their efforts across other high-dependency IoT industries.

“Attackers are pivoting to areas with maximum impact. We’re seeing a YoY rise of 67% in malware targeting mobile devices and 387% in IoT/OT attacks on energy sectors often hosting critical infrastructure, which is a massive swing,” said Deepen Desai, EVP and Chief Security Officer at Zscaler. “A Zero Trust everywhere approach, combined with AI-powered threat detection, is imperative to reducing the attack surface, limit lateral movement, and provide organizations the defense they need against ever-evolving attacks.”