New Zimperium Research Reveals that AI-based Attacks are Targeting and Succeeding on Mobile

News Highlights

• AI has supercharged phishing. Phishing events detected on employee mobile devices grew 380% since January 2025, and the number of devices where employees clicked a malicious link grew 110% in 2025 over the previous year.  
• Shadow AI in Mobile Apps is exploding. AI adoption in mobile apps has grown 14x on Android and 7x on iOS, creating new blind spots for security and compliance teams.
• AI-Assisted Malware Drives Fraud. The median threat actor now uses AI across 15 MITRE attack techniques, sometimes using as many as 40 to 50 techniques.
• Vibe coding compounds app risk. By 2027, 25% of software defects will trace to AI-generated code, up from less than 1% in 2023.

DALLAS, July 29, 2026 /PRNewswire/ -- Zimperium, the global leader in AI-empowered mobile security, today released its 2026 Global Mobile Threat Report, revealing that artificial intelligence is accelerating the speed, scale, and sophistication of mobile attacks years ahead of enterprise readiness. The report, which is primarily based on findings from Zimperium's zLabs research team, indicates that AI is fundamentally reshaping the mobile threat landscape, enabling more convincing and scalable mobile phishing campaigns, increasingly ed malware, exploding Shadow AI risks, and a new generation of vulnerable, vibe coded mobile applications.

While organizations have invested heavily in securing traditional endpoints, cloud infrastructure, and networks, mobile remains an afterthought for many organizations. Consequently, with the help of AI, mobile has become the most vulnerable attack surface in the enterprise.

"AI has changed the game on securing mobile. It's making mobile attacks easier, scalable, and much more sophisticated. It's forcing organizations to rethink how they ensure trust and guard against fraud on the devices and mobile apps that their employees and customers rely on every day," said Shridhar Mittal, CEO of Zimperium. "Whether in the private sector or government, mobile devices and apps have become central to driving business, building customer trust, and enabling mission-critical operations. But for the most part, mobile continues to be the least protected surface in the enterprise. In the meantime, AI has lowered the bar for exploiting both devices and the mobile apps themselves; consequently, the sophistication and volume of threats that were expected five years from now are here today. Organizations and their shareholders are facing one of the greatest cybersecurity risks we've seen in recent years and most have no contingency."

According to some sources AI-assisted phishing campaigns have reportedly grown at a rate of more than 1200%. Zimperium's data shows that phishing events detected on employee mobile devices grew 380% since January 2025, and the number of devices where employees clicked a malicious link grew 110% in 2025 over the previous year.  The report also found that AI is used to generate content estimated to be 4.5x more convincing than anything human-written while almost 86% of phishing attacks now contain AI-generated elements.

These findings highlight how generative AI is enabling attackers to launch increasingly personalized and scalable phishing campaigns.

Spyware also continues to proliferate across enterprise devices. The report found spyware is now present on nearly one in ten mobile devices—an increase of more than 4x year over year, giving attackers greater opportunities to steal credentials, monitor communications, and access sensitive enterprise data.

Beyond external threats, organizations are also facing growing internal risk as employees increasingly adopt AI-enabled mobile applications. AI adoption within mobile applications has grown 14x on Android and 7x on iOS, creating new challenges around data privacy, governance, compliance, and intellectual property protection.

The report also examines how AI-assisted application development is reshaping enterprise mobile security. While AI is accelerating software development, it is also introducing new opportunities for vulnerabilities if AI-generated code is not properly secured throughout the application lifecycle. The findings reinforce the importance of integrating security throughout the development process to reduce risk before applications reach production.

The report's findings reinforce that AI is fundamentally reshaping the enterprise mobile threat landscape, requiring organizations to rethink how they secure mobile devices, applications, and the sensitive data they access. As attackers continue to innovate faster with AI, enterprises need a mobile security strategy purpose-built for today's rapidly evolving threats.

Download the full 2026 Global Mobile Threat Report HERE.

About the Zimperium 2026 Global Mobile Threat Report
The Zimperium 2026 Global Mobile Threat Report examines the latest trends shaping the enterprise mobile threat landscape, including AI-assisted phishing, mobile malware, Shadow AI, and application security. Developed by zLabs, Zimperium's global threat research team, the report draws on analysis of millions of enterprise mobile devices and applications, threat intelligence, and mobile security research to provide insights into the evolving threats targeting mobile devices and applications.

About Zimperium
Zimperium is the world leader in AI-empowered mobile security. Purpose-built for mobile, Zimperium provides unparalleled protection for mobile applications and devices, leveraging the power of AI to deliver autonomous mobile security that counters evolving threats including mobile phishing (mishing), malware, app vulnerabilities, app tampering, device compromise, and even zero-day attacks. Cybercriminals have adopted a mobile-first attack strategy, targeting your most vulnerable attack surface - the mobile apps and devices that your organization and customers depend upon.

CONTACT: [email protected] 

SOURCE Zimperium