Mobile malware is malicious software designed to run on smartphones and tablets, mainly Android and iOS devices, in order to steal data, credentials or money, spy on the user, display fraudulent advertising or take control of device functions. In mobile security it differs from desktop malware because it must work within app sandboxing, permission systems and curated app stores, so most attacks focus on tricking users or abusing legitimate features rather than freely infecting the system.
The category ranges from mass-market banking trojans and adware distributed through fake apps to rare, expensive commercial spyware that uses zero-click exploit chains against selected targets. Understanding which kind is realistic for a given user or organization is the starting point of effective defense.
How mobile malware reaches and controls devices
Because mobile operating systems isolate apps from one another, getting installed is the first and hardest step. Common infection routes are sideloaded apps from websites or messages, malicious apps that slip through store review, often by downloading their harmful code after approval, and links that lead users to install configuration profiles or remote-access tools.
Once installed, mobile malware typically abuses permissions the user granted. On Android, the Accessibility Service is especially valuable to attackers, because it can read screen content, click buttons and approve actions. Other routes are notification access to intercept one-time codes, overlay windows that imitate banking apps, and device administrator rights that make removal harder.
The table compares the main infection vectors.
| Vector | How it works | Typical platform |
|---|---|---|
| Sideloaded app | User installs a file from outside the store | Mainly Android |
| Dropper in a store app | Clean app downloads malicious code later | Android, occasionally iOS |
| Smishing link | SMS or chat message leads to a fake page or app | Both platforms |
| Malicious profile or MDM enrollment | User installs a profile granting control | Mainly iOS |
| Zero-click exploit | Vulnerability triggered without user action | Both, highly targeted |
Types of mobile malware
Mobile malware families are usually classified by their main goal, although modern samples often combine several functions in one package controlled from a command-and-control server.
| Type | Main goal | Typical behavior |
|---|---|---|
| Banking trojan | Steal financial credentials | Overlays, SMS and code interception |
| Spyware and stalkerware | Monitor a person | Location, messages, microphone, camera |
| Adware and ad fraud | Generate advertising revenue | Hidden ads, fake clicks, battery drain |
| SMS and billing fraud | Charge premium services | Silent subscriptions, premium SMS |
| Remote access trojan | Full device control | Screen streaming, remote input |
| Ransomware and lockers | Extort payment | Locked screen or encrypted files |
Mercenary or commercial spyware is a distinct class. It is sold to governments, uses chains of unknown vulnerabilities, and is aimed at journalists, officials and activists. It is rare for ordinary users but represents the most capable mobile threat, and it can affect fully updated devices until a patch exists.
Mobile malware on Android compared with iOS
Both platforms use strong app sandboxing and code signing, but their openness differs, and that shapes the malware seen on each. Android allows sideloading and alternative stores, which lets mass-market malware spread through social engineering. iOS restricts installation more strictly, so attacks rely more on phishing, malicious profiles and expensive exploits.
| Aspect | Android | iOS |
|---|---|---|
| Installation outside the store | Allowed with user consent | Limited, regionally expanding |
| Most common threat | Banking trojans, adware | Phishing, profiles, targeted spyware |
| Built-in scanning | Google Play Protect | Store review, notarization in some regions |
| Update fragmentation | Varies by manufacturer and model | Broad, fast updates for supported devices |
| Extra protection mode | Advanced protection settings | Lockdown Mode |
Detection and protection
Defending against mobile malware relies on layers rather than one tool, because mobile antivirus apps also run inside the sandbox and cannot inspect other apps deeply.
- Install apps only from official stores and verify the developer before installing.
- Keep the operating system updated, and replace devices that no longer receive security patches.
- Review sensitive permissions, especially Accessibility, notification access and device administration.
- Use phishing-resistant authentication such as passkeys, which malware cannot simply read from SMS.
- Enforce policies through MDM on company devices, blocking sideloading and outdated versions.
- Enable high-risk modes such as Lockdown Mode for people likely to face targeted spyware.
Warning signs include unexplained battery drain, data usage spikes, new apps with no icon, ads appearing outside apps and unexpected Accessibility permissions. These signs are not proof of infection, and advanced spyware often shows none of them.
When infection is suspected on a managed device, the safest response is isolation and evidence first, cleanup second. Security teams disconnect the device from corporate resources, revoke its sessions and tokens, and collect app lists, profiles and logs before acting. For ordinary malware, removing the app and its administrator rights, or performing a factory reset without restoring app backups, is usually enough. For suspected mercenary spyware, specialized forensic analysis of device backups and system logs is needed, because these tools are designed to leave few visible traces and may persist until the next reboot or patch.
Common misconceptions about mobile malware
Discussions of mobile malware often swing between complacency and alarm. Both lead to poor decisions.
| Misconception | Correct view |
|---|---|
| iPhones cannot get malware | Targeted spyware and phishing still affect iOS |
| Store apps are always safe | Droppers and malicious updates occasionally pass review |
| Antivirus apps solve the problem | Updates, permissions and store discipline matter more |
| A factory reset removes everything | It usually works, but backups can restore malicious apps |
| Slow phones are infected | Aging batteries and storage are far more common causes |
Put simply
Mobile malware is a harmful app on a phone or tablet. It may steal passwords, read your messages, empty a bank account or simply show endless ads.
Phones keep apps in separate boxes, so malware usually cannot break in alone. Instead, it tricks you into opening the door, for example with a fake delivery text that asks you to install an app. The best protection is simple: install apps only from the official store, keep the phone updated and be suspicious of unexpected requests for special permissions.
In practice
An employee receives a text message claiming a parcel is held at customs, with a link to a tracking app. The page asks the user to allow installation from unknown sources and then to enable an Accessibility Service for the app. Within hours, the app shows a fake overlay over the company’s banking app and intercepts one-time codes from notifications.
The company’s MDM policy blocks installations from unknown sources on managed phones, so the same attempt fails on the work device. On the personal phone, the bank’s fraud system flags an unusual transfer and stops it. The incident leads the company to roll out passkeys and security awareness training focused on smishing.