The Growing Threat of Mobile Infostealers

Executive Summary

Mobile infostealers have rapidly evolved into a critical threat vector for both individuals and enterprises. These malicious apps are designed to harvest credentials, intercept communications, and exfiltrate sensitive data—often without detection. As businesses become increasingly dependent on mobile, cybercriminals have adopted a mobile-first attack strategy to exploit inattentive users and their often unprotected mobile devices.

This report highlights five active mobile infostealer families detected in the wild by Zimperium’s detection engine: TriaStealer, TrickMo, AppLite, Triada, and SMS Stealer. These malware strains target financial services, communications platforms, and authentication mechanisms, with tactics ranging from overlay attacks that mimic the user’s screen to pre-installed firmware backdoors.

Key findings include:

• Over 2,400 variants detected, with 69 countries impacted
• Zero-day detection of three malware families was made before any public IOC’s were released
• Southeast Asia identified as a major hotspot for infections
• Most impacted industries: finance, retail, and software

Zimperium’s on-device, dynamic detection engine, leveraging advanced AI capabilities, enabled proactive detection of these previously unknown threats, even in the absence of public IOCs. This underscores the critical importance of real-time, behavioral-based mobile threat defense.

For more information, visit Zimperium.