Mobile security: beware of untrustworthy apps

Mobile security is very important for people who use smartphones and tablets in Italy. In 2025, threats to mobile devices increased. Data protection and online privacy are now essential.

Reports from Kaspersky, ESET and AV‑TEST show an increase in attacks. These attacks steal banking credentials and use the microphone and camera for surveillance.

The risks include the loss of online privacy and the theft of sensitive information. Ransomware and cryptomining can also slow down the device. Amnesty International and other reports highlight how seemingly harmless apps can be dangerous.

This article helps readers and businesses better understand the risks. It shows how to identify and avoid threats. The aim is to improve data protection and everyday mobile security.

Why mobile security is crucial in 2025

The smartphone has become the centre of digital life. In just a few years, cyber risks have multiplied, putting personal and professional information at risk. Privacy protection is no longer optional; it requires constant attention from users and businesses.

Recent trends show a sharp increase in attacks. Kaspersky reports a +29% increase in Android attacks in the first half of 2025 compared with H1 2024. In Q1 2025 alone, around 12 million mobile attacks were blocked and around 180,000 new Android malware packages were detected.

Recent trends and statistics

In 2025, Google removed 77 harmful apps with more than 19 million installations from the Play Store, according to BleepingComputer. Reports from ESET and Zscaler confirm targeted campaigns against female journalists and activists, using sophisticated exploits. Amnesty International documented espionage attempts using tools such as Pegasus during the same year.

Types of threats affecting smartphones and tablets

Cyber threats affecting mobile devices include stalkerware and spyware that monitor calls, messages and locations, and activate the microphone or camera without consent. Banking trojans such as Anatsa and TeaBot use overlays to steal credentials and target financial and crypto apps.

Other vectors include RAT, ransomware, adware and cryptominers that drain the battery and cause overheating. Zero-click exploits remain the choice of state actors for targeted espionage operations.

Impact on individual users and businesses

For individual users, the harm ranges from loss of confidentiality to identity theft. Cases of blackmail and unauthorised access to bank accounts have been recorded. Privacy protection therefore becomes urgent to prevent financial and reputational damage.

Businesses need to manage BYOD and COPE environments with MDM policies and catalogues of trusted apps. Cyber threats can expose credentials and sensitive business data. Reports from AV‑TEST and Kaspersky recommend dedicated solutions to reduce risk and improve mobile security.

Area	2025 data	Main impact
Android attacks (H1 vs H1)	+29% (Kaspersky)	Increased exposure to trojans and exploits
Attacks blocked	~12 million in Q1 (Kaspersky)	High level of threat scanning activity
New malware packages	~180,000 for Android	Greater diversity of threats
Harmful apps removed	77 with >19M installations (BleepingComputer)	Spread through app stores and sideloading
Targeted campaigns	Attacks against female journalists and activists	Use of advanced exploits such as Pegasus

How untrustworthy apps and stalkerware reach your device

Mobile security threats are often simple. An app looks harmless but hides intrusive features. These compromise the protection of the user’s data.

Common infection channels

Unofficial APK downloads are the most common method. They take place through fake websites or links sent via messaging apps. This method exposes the smartphone to malware and stalkerware.

Visits to malicious websites can trigger drive-by downloads. These exploit browser vulnerabilities to install malicious code. Email attachments or messages containing social engineering links are effective at persuading the victim to run a file.

Legitimate-looking apps as a cover

Some apps pose as parental control or business monitoring tools. However, sideloaded versions of these apps can hide stalkerware.

Banking trojans hide behind PDF readers or everyday utilities. Spy services such as Spyzie and Cocospy have caused data leaks. This increases the risk for users and attackers.

Limitations of official app store checks

The official app store does not guarantee complete security. Google Play Protect detects many threats. However, harmful apps with millions of installations were also removed in 2025.

Google has introduced real-time scanning and analysis to reduce the risks of sideloading. However, additional layers of checks are needed. For better data protection, it is advisable to check reviews, review permissions and use dedicated security solutions.

Signs of a possible infection on your smartphone

A compromised device shows clear signs. Even people without technical expertise can notice them. These symptoms can help protect privacy and limit the damage.

Indicators for non-expert users

Unusual battery drain and overheating for no apparent reason are common signs. A sudden increase in data usage may indicate unauthorised activity.

The camera or microphone activating on their own, or interference during calls, are signs of intrusion. Strange pop-ups, unfamiliar apps and intrusive advertising are often signs of malware.

Slow performance, frequent freezes or unexpected restarts are other signs. If you notice these problems, it is important to act immediately to stay secure.

Suspicious permissions and settings

Checking permissions is essential. Apps that request Accessibility or Display over other apps permissions without a reason should be viewed with suspicion.

New administrator profiles or VPNs not configured by the user indicate a possible compromise. Checking Settings → Apps → Special app access helps identify misuse.

Revoking unnecessary permissions and removing unknown profiles reduces the risk. Regularly using mobile antivirus software helps detect excessive permission requests.

Advanced technical signs

Persistent foreground services and dynamic payload loading (DEX) are technical signs. Obfuscated code and overlays used for phishing indicate sophisticated attacks.

Unusual network patterns involving suspicious domains or communications with command-and-control servers require specialised tools. Behavioural monitoring flags deviations from normal operation.

For further investigation, using Play Protect and dedicated solutions such as Anti Spy is recommended. This improves security and protects online privacy.

Sign	Description	Recommended action
Unusual battery drain	Battery draining much faster than usual	Close background apps, run a scan with mobile antivirus software
Unintended microphone/camera activation	Devices recording or taking photos without consent	Revoke permissions, remove suspicious apps, check for indicators of compromise
Unknown apps or files	Unauthorised installations or unrecognised entries in the app list	Uninstall, run an Anti Spy scan, check permissions
Unknown administrator/VPN profile	Presence of MDM or VPN configurations not set up by the user	Remove unrecognised profiles, reset network settings
Network traffic to suspicious domains	Repeated connections to unusual or unknown external servers	Use specialist network tools, isolate the device

Immediate actions and best practices for data protection

If you think your data has been compromised, it is important to follow a clear action plan. This plan helps reduce the risk and protect your privacy. By doing so, you can better assess the seriousness of the situation.

Quick steps to take if you suspect a problem

First, put the device in aeroplane mode. This blocks all active connections. Then check whether updates are available for the system and Play Protect.

To activate Play Protect, open the Play Store, go to your profile and select Play Protect. Then go to settings and enable “Scan apps” and “Improve harmful app detection”.

Install and launch Anti Spy by Protectstar to run a scan. Follow the instructions to remove any threats. Afterwards, activate an AI antivirus and run another scan.

Check and revoke special permissions such as Accessibility and Device administrator. Change your passwords and enable two-factor authentication for your accounts.

Everyday digital hygiene

Only download apps from official stores such as Google Play. Read reviews and check the developer. Avoid sideloading unless necessary.

Keep the operating system and apps up to date. This improves security and reduces risks.

Use a password manager and never use the same password for multiple accounts. Avoid public Wi-Fi networks or use a VPN to protect your communications.

Limit app permissions and install mobile antivirus software. Disable unnecessary features such as Bluetooth and NFC for greater security.

Actions to take if the compromise is serious

Back up your important data, excluding APKs or suspicious files. If you cannot resolve the problem, restore the device to its factory settings.

Only reinstall safe apps after the reset. If you think there has been a zero-click attack, consider replacing the device and ask a digital forensics expert for help.

Report the incident to the authorities and contact support services for victims of domestic abuse if the threat is related to this. The Coalition Against Stalkerware offers support and advice for victims of non-consensual surveillance.

Following these practices helps protect your data every day. Consistent digital hygiene improves your online security and reduces risks.

Recommended tools and solutions for cyber defence

Protecting smartphones and tablets requires multiple layers of protection. Effective cyber defence uses platform controls, dedicated solutions and company policies. This reduces risks and protects data.

The system’s built-in protection is a first step. Play Protect checks apps before and after installation. From 2023, Google introduced real-time code analysis. The improvements in 2024/25 enhanced its ability to block threats.

Play Integrity API replaces SafetyNet for businesses. It provides integrity signals that are useful in zero-trust architectures. However, Play Protect does not catch all sophisticated threats. It is therefore useful to add third-party tools.

The role of Play Protect and platform protections

Play Protect provides a good security baseline for Android. It scans installed and sideloaded apps. It removes harmful apps and flags suspicious behaviour.

Businesses can use Play Integrity to assess a device’s status. This helps with granting access to resources. However, Play Protect does not replace specialist solutions. Additional checks and continuous monitoring need to be integrated.

Dedicated solutions: Antivirus AI and Anti Spy

For real-time protection, a two-stage approach is recommended. First, run a thorough scan with specialised anti-spyware software. Certified products detect stalkerware and spyware, encrypt data and minimise logs.

After the initial scan, enable mobile antivirus software with multiple engines and artificial intelligence. Tests from January 2025 show high detection rates, including banking trojans and ransomware.

A recommended workflow for users is to use Anti Spy to remove spyware and check special permissions on Android. Then keep the antivirus software’s real-time protection enabled to block new infections.

Tools for businesses

Businesses need to adopt Mobile Device Management (MDM) or Enterprise Mobility Management (EMM). These systems restrict sideloading and the granting of Accessibility permissions. They also allow VPN profiles to be deployed and policies to be managed centrally.

A catalogue of trusted apps reduces the risk of unauthorised installations. Conditional access based on signals such as patch level and Play Integrity protects sensitive resources. This helps protect company data.

For business endpoints, deploying Anti Spy and mobile antivirus solutions with centralised configurations is recommended. Policies should include enforced updates, secure logging and reporting for audits and compliance.

Certified solutions with data minimisation policies increase trust. Validations such as MASA-L1 and technical reports provided by independent organisations improve transparency and facilitate compliance.

A technical look at detection methods and IoC

This in-depth look shows how to improve mobile device security. It covers behavioural signals and the limitations of current techniques. It also examines indicators of compromise from 2025.

Behavioural analysis techniques

Modern security uses heuristics to monitor permissions and API calls. Persistent services and dynamic DEX loading are monitored as important signals.

Accessibility abuse and click-hijacking create recognisable patterns. Monitoring network traffic identifies suspicious C2 connections and unusual requests to unknown domains.

A dual engine with machine learning compares behaviour against known baselines. This detects anomalies before data exfiltration. It also integrates threat intelligence feeds to update IoC in real time.

Indicators of compromise observed in 2025

Researchers have catalogued useful IoC such as package names and C2 domains. ESET has reported ProSpy/ToSpy campaigns that use fake domains and recurring C2 patterns.

Zscaler has documented Anatsa and TeaBot using overlays to collect credentials. Kaspersky reported 180,000 new Android malware packages in the first quarter of 2025.

The volume of mobile attacks is high: millions of attempts blocked by providers. Leaks from stalkerware services such as Spyzie highlight the security risks of commercial surveillance services.

Limitations and warnings about advanced attacks

Zero-click exploits can bypass many signature-based detection methods. No system guarantees 100% coverage against sophisticated threats.

Code obfuscation and dynamic payload loading limit static analysis. Anti-analysis techniques and polymorphic behaviour make it necessary to combine sandboxing with behavioural analysis.

To mitigate the risk, prompt patching and restrictions on device communications are suggested. Considering replacing the device in the event of a targeted attack is advisable. Integrating Play Protect, Play Integrity and endpoint solutions increases coverage of indicators of compromise.

Conclusion

In 2025, mobile devices are more vulnerable. Risks such as stalkerware and banking trojans are increasingly common. Paying attention to mobile security and privacy is essential.

To protect devices, it is important to act on several fronts. Enabling Play Protect and regularly updating systems are essential steps. Restricting app permissions and maintaining digital hygiene are equally important.

Using solutions such as Antivirus AI and Anti Spy can help provide protection. These tools detect suspicious behaviour and offer proactive protection.

If you suspect suspicious activity, follow the recommended steps. Use certified tools such as AV-TEST and DEKRA MASA-L1. Reporting abuse to the authorities and organisations such as the Coalition Against Stalkerware is crucial.

With high-level threats, caution is necessary. In an emergency, it may be necessary to reset or replace the device. Combining technical protections and good practices reduces the risk of compromise.

FAQ

Why is mobile security crucial in 2025?

In 2025, threats to mobile devices have increased significantly. Kaspersky saw a +29% increase in attacks on Android in the first half of 2025. Around 12 million attacks were blocked in Q1 2025. In addition, ~180,000 new Android malware packages were discovered.

This increase makes protecting sensitive data on smartphones and tablets essential. It is important to prevent loss of privacy, theft of banking credentials and surveillance through the microphone/camera. Protection against ransomware or cryptominer infections is also necessary.

What types of threats affect smartphones and tablets?

The main threats include stalkerware/spyware that records calls, messages and location. They also include banking trojans such as Anatsa/TeaBot that use overlays to steal credentials. There are also RAT, ransomware, adware and cryptominers that drain the battery and consume resources.

Zero-click exploits are used in state-level espionage campaigns (e.g. Pegasus). Commercial spying services and apps disguised as utilities or parental controls also pose risks.

What impact can these attacks have on individuals and businesses?

Individual users risk losing their privacy, being blackmailed, suffering identity theft and having their bank accounts compromised. Businesses face risks in BYOD/COPE environments. Theft of company data, access to internal credentials and compromised resources are the main risks.

Businesses are advised to adopt MDM/EMM policies, trusted app catalogues and centralised endpoint security solutions.

How do untrustworthy apps and stalkerware get onto a device?

The main channels include sideloading through unofficial APKs downloaded from fake websites. There are also links in messaging apps or phishing emails. Drive-by downloads from malicious websites that exploit browser vulnerabilities are common.

Malicious email attachments and social engineering campaigns are other channels. Some threats pose as legitimate apps, such as PDF readers or parental control tools, leading users to install them.

How are legitimate apps used as cover for malware?

Some apps are designed or modified to look like useful tools. Parental controls, employee monitoring and utilities are common examples. But they abuse permissions to record calls, activate the microphone/camera or read messages.

Studies such as the one by UCL have shown that several sideloaded parental control apps display indicators associated with stalkerware. Commercial surveillance services have also suffered data leaks, exposing further risks.

Why are official app store checks not enough?

Play Store and Play Protect are improving code analysis and scanning for sideloaded apps. But they do not detect every sophisticated variant. In 2025, Google removed 77 harmful apps with over 19 million installations.

This shows that threats also spread through official app stores. It is advisable to keep Play Protect enabled but add dedicated solutions and digital hygiene practices.

What visible signs can indicate a possible infection to a non-expert user?

Common signs include unusual battery drain and persistent overheating. High data usage and random activation of the microphone or camera are other signs. Noises during calls, unfamiliar apps or files and unusual pop-ups are common.

Unusual adverts, constant sluggishness and sudden freezes or restarts are also signs of infection.

Which permissions and settings are suspicious and should be checked?

Check apps that request Accessibility, Display over other apps, access to all files or device administrator privileges without a clear need. Also check for unauthorised VPN/MDM profiles.

On Android, Settings → Apps → Special app access helps identify excessive permissions and revoke them if they are unjustified.

Which advanced technical signs may indicate a compromise?

Advanced indicators include persistent foreground services and dynamic payload loading (DEX). Code obfuscation and unusual network patterns involving suspicious domains or C2 are other signs. The use of overlays for phishing and abuse of Accessibility APIs to automate malicious actions are also signs.

These signs can be detected through behavioural analysis and specialised tools.

What should you do immediately if you suspect a compromise?

Quick steps include enabling aeroplane mode. Checking for system and Play Protect updates is important. Enabling Play Protect (Play Store → Profile → Play Protect → ⚙️ → enable “Scan apps”) helps protect the device.

Running a scan with Anti Spy and then with Antivirus AI with real-time protection is advisable. Reviewing and revoking special permissions, changing passwords and enabling 2FA on compromised accounts are essential steps.

Which everyday practices reduce the risk of infections?

Downloading apps only from official stores and checking reviews and the developer is important. Avoiding unnecessary sideloading helps reduce the risk. Keeping the operating system, Google Play services and apps up to date is crucial.

Using password managers, avoiding unsecured public Wi-Fi or using a trusted VPN is advisable. Restricting permissions and disabling unused features (Bluetooth, NFC) helps protect the device. Installing mobile antivirus software is also recommended.

What should you do in the event of a serious compromise or a suspected targeted attack?

For severe infections, making a selective backup (excluding unsafe APKs) is advisable. Restoring the device to factory settings and reinstalling only trusted apps helps protect sensitive data.

If a zero-click exploit or targeted spying is suspected, considering a replacement device is a good option. Specialist advice and reporting to the authorities are essential. Contact support services for victims of domestic violence and the Coalition Against Stalkerware if necessary.

What role does Play Protect play, and what are its limitations?

Play Protect performs pre- and post-installation analysis and can automatically remove harmful apps. It also offers scanning for sideloaded apps. Google has introduced real-time code analysis and the Play Integrity API for enterprise integrity signals.

However, Play Protect does not detect every sophisticated variant. It is a good baseline layer, but it should be supplemented with additional solutions and corporate security policies.

Which dedicated solutions are recommended for mobile cyber defence?

Specialist solutions such as Antivirus AI (dual engine with self-learning AI, AV-TEST certified with a detection rate of 99.8% in January 2025) offer in-depth scans and real-time protection. Anti Spy (specialising in spyware/stalkerware, with AV-TEST and DEKRA MASA-L1 certifications) helps detect suspicious behaviour.

It is advisable to run Anti Spy first for a full scan and then enable real-time protection in Antivirus AI.

Which tools and policies should businesses adopt?

Businesses should use MDM/EMM to restrict sideloading and Accessibility permissions. Maintaining catalogues of trusted apps and enforcing conditional access based on integrity signals (patch level, bootloader status, Play Integrity) is important. Deploying endpoint solutions such as Antivirus AI and Anti Spy with centralised policies and continuous monitoring helps protect business data.

Which behavioural analysis techniques are effective at detecting mobile malware?

Effective techniques include monitoring permission graphs and analysing API call sequences. Identifying persistent foreground services and detecting dynamic DEX loading are important. Heuristics for Accessibility abuse and overlays help identify threats.

Using a dual engine combined with self-learning AI helps compare behaviour against known patterns and identify anomalies.

Which indicators of compromise (IoC) were observed in 2025?

In 2025, IoC emerged, including package names of widespread malware (e.g. ProSpy/ToSpy campaigns), domains and C2 patterns. Suspicious network patterns associated with Anatsa/TeaBot and overlays used for phishing were observed. Reports from Kaspersky, ESET, Zscaler and AV‑TEST document 180,000 new malware packages in Q1 2025 and mass campaigns that exploited fake websites and deceptive download pages.

What are the limitations of defending against advanced attacks such as zero-click exploits?

Zero-click exploits can bypass many traditional detection methods and operate without user interaction. No solution guarantees 100% detection. Practical countermeasures include timely patching, communication restrictions, advanced behavioural monitoring and, if necessary, device replacement.

Analysts need to consider code obfuscation and anti-analysis techniques that complicate detection based solely on signatures.