Mobile phishing attacks grew substantially in 2024, with cybercriminals exploiting multiple attack vectors and targeting users worldwide. According to Kaspersky’s findings, phishing attempts increased by 26 percent globally, with the security firm blocking over 893 million attempts through their solutions. The surge continues a pattern of escalating mobile threats that security researchers have been tracking since 2022.
Smishing (SMS-based phishing) emerged as the predominant mobile phishing vector, with highest activity rates recorded in India (37 percent), the United States (16 percent), and Brazil (9 percent). The trend has prompted significant countermeasures, including LG Uplus’s recent deployment of AI-powered smishing detection systems and the expansion of the Mobile Ecosystem Forum’s anti-smishing initiative to multiple countries. Additionally, Quishing (QR code phishing) gained traction, particularly in Japan (17 percent), the U.S. (15 percent), and India (11 percent), leading to innovations like Rochester University’s SDMQR technology designed to combat such threats.
The research identified several key trends in mobile-specific attacks. Notably, 3 percent of phishing sites employed device-specific redirection techniques, displaying harmless content on desktop devices while serving malicious payloads to mobile users. Attackers also exploited security gaps in cloud and mobile business applications, expanding the potential attack surface for credential theft. Google has responded to these threats with enhanced Android security features, including improved detection of device-specific redirections.
Mobile-targeted email phishing demonstrated increased sophistication, with attacks specifically designed to circumvent desktop security measures. The practice of CIDR block reuse for hosting multiple phishing domains has become more prevalent, enabling attackers to extend their reach and persistence. Attack activity reached its peak in August 2024, with over 1,000 daily attack records documented.
Man-in-the-Middle (MitM) phishing techniques have evolved to bypass two-factor authentication during active web sessions. Tools originally designed for penetration testing, such as Evilginx, have been repurposed for these attacks, operating as intermediaries between victims and legitimate websites. The development is particularly concerning as AI-driven fraud techniques continue to evolve, making traditional authentication methods increasingly vulnerable.
The financial sector faced significant impacts from these attacks. Social engineering campaigns affected both individuals (38 percent) and credit institutions (36 percent), resulting in financial losses (50 percent), fraud (28 percent), and exposure of personal information. Ransomware attacks primarily targeted service providers (29 percent) and insurance organizations (17 percent), leading to financial losses (38 percent), data exposure (35 percent), and operational disruptions (20 percent).
The holiday season traditionally sees increased phishing activity, with fraudsters targeting travelers through fake airline and hotel bookings, deceptive tour packages, and fraudulent offers. The seasonal surge in attacks has become more sophisticated with the integration of AI-powered techniques, as highlighted in recent FBI warnings about phishing campaigns targeting email users.
Sources: Government Technology, ENISA, Kaspersky, Zimperium, Wikipedia
Follow Us