The agency reports that mobile devices now face a broad and complex attack surface. Their constant connectivity, multiple built-in radios, and sensitive stored data make them valuable targets for different groups. Since 2015, threat actors have expanded their techniques, combining older strategies with new exploitation paths to gain entry, track users, or install malware without being noticed.
A significant part of the threat comes from wireless interfaces. Weaknesses in cellular protocols allow attackers to intercept traffic, monitor device activity, or exploit network features designed for legacy compatibility. Wi-Fi adds another layer of exposure through rogue access points, forced connections, or flaws in hotspot security. Bluetooth can be used to track a device or deliver malicious code when vulnerabilities are present. Near-field communication introduces additional opportunities when attackers can control a device’s physical environment.
Beyond radio interfaces, attackers rely heavily on device software. The study shows consistent use of vulnerabilities in operating systems, shared libraries, and core applications. Some methods require users to interact with a malicious message or file, while others use zero-click chains that operate silently. These techniques often target messaging apps, media processing components, browsers, and wireless stacks. Baseband processors, which handle radio communication, remain high-value targets because they operate outside the main operating system and offer limited visibility to the user.
Compromise can also occur through direct physical access. In some environments, phones are temporarily seized during border checks, police stops, or arrests. When this happens, an attacker may install malicious applications, create persistence, or extract data before the device is returned. Mandatory state-controlled apps in certain regions introduce additional risk when they collect extensive device information or bypass standard security controls.
Another section of the review focuses on application-level threats. Attackers may modify real apps, build fake versions, or bypass official app stores entirely. Some campaigns hide malicious components inside trojanized updates. Others use device management tools to take control of settings and permissions. The agency notes that social engineering still plays a major role. Phishing messages, fraudulent links, and deceptive prompts remain common ways to push users toward unsafe actions.
The ecosystem around mobile exploitation has grown as well. Private companies offer intrusion services to governments and organizations. These groups develop exploit chains, manage spyware platforms, and sell access to surveillance tools. Advertising-based intelligence providers collect large volumes of commercial data that can be repurposed for tracking. Criminal groups follow similar methods but aim for theft, extortion, or unauthorized account access. Stalkerware tools, designed to monitor individuals, continue to circulate and provide capabilities similar to more advanced platforms, though on a smaller scale.
The study documents several real-world campaigns observed in recent years. They include zero-click attacks delivered through messaging services, exploits hidden in network traffic, some campaigns that exploited telecom network-level malicious traffic to target users. Some operations rely on remote infection, while others use carefully planned physical actions. The range of techniques shows that attackers adapt to different environments and skill levels.
To reduce exposure, the agency recommends a mix of technical and behavioral steps. Users should disable Wi-Fi, Bluetooth, and NFC when they are not needed, avoid unknown or public networks, and install updates quickly. Strong and unique screen-lock codes are encouraged, along with limiting app permissions. The study advises using authentication apps instead of SMS for verification and enabling hardened operating-system modes when available. Organizations are urged to set clear policies for mobile use and support users with safe configurations.
The report concludes that smartphones will remain attractive targets because they store sensitive information and stay connected to multiple networks. The findings highlight the need for coordinated responses, including international cooperation such as the work developed by France and the United Kingdom through their joint initiative on mobile security.
Notes: This post was drafted with the assistance of AI tools and reviewed, edited, and published by humans. Image: DIW-Aigen.
Read next: The Technology Consumers Will Spend More on in the Next 5 Years
