Mobile threats by the numbers: what the data supports, and what it cannot

Our assessment: every headline number is a floor

The Lab reads mobile threat statistics with one principle: a number describes its sample, and the sample is usually a vendor’s customers, a vendor’s detections or a government’s list. None of the figures below is a rate for all phones. Counts also move after publication. Google’s 2025 review revised its 2023 total from 98 to 100 and its 2024 total from 75 to 78[S1], which is what a floor does when more evidence arrives.

Zero-days: the clearest count

Google’s Threat Intelligence Group counted 90 zero-day vulnerabilities exploited in the wild in 2025, against 78 in 2024 and 100 in 2023. Mobile operating systems accounted for 15 in 2025, 9 in 2024 and 17 in 2023; the 2025 report does not split Android from iOS [S1][S2].

Three details matter more than the totals. Browsers were under 10 percent of 2025 zero-day exploitation, a marked decrease from 2021 and 2022, so attackers moved to other components[S1]. Several 2025 chains needed three or more vulnerabilities[S1], and in 2024 chains of multiple zero-days were almost exclusively, about 90 percent, aimed at mobile devices[S2]. And for the first time, Google attributed more exploitation to commercial surveillance vendors than to traditional state-sponsored espionage groups[S1]. Google’s 2025 report gives no exact count for that group, so we do not quote one. Platform detail is thinner. For 2024 Google counted seven exploited Android zero-days, three of them in third-party components, and five for Apple[S2]. Of the 90 in 2025, 43 targeted enterprise products and 47 end-user platforms[S1].

The government ledger

CISA’s Known Exploited Vulnerabilities catalog is a list of flaws the agency has evidence were exploited. On 21 October 2026 it held 1,754 entries. Apple accounts for 95; of those, 54 are combined "Multiple Products" entries that span iOS, iPadOS, macOS and the web engine and cannot be separated by platform from the catalog alone. Android-platform entries total 17, plus one entry for Chrome on Android[S3]. We computed the yearly counts from CISA’s data file; they are not a published CISA statistic.

Read the chart with care. It counts the year an entry was added, not the year exploitation happened: three older Apple vulnerabilities from 2021 to 2023 were added on 5 March 2026[S3]. The catalog also shows only what was reported to or found by the agency.

The National Vulnerability Database counts something different again: published flaws. For records matching iPhone OS it lists 335 for 2025 and 652 for 2026 through 20 October; for Android, 485 and 865. NIST’s tagging of products lags, and the Android peak of 1,483 in 2023 against 618 in 2024 partly reflects processing backlog and tagging practice[S4]. A published flaw is not an exploited one, and the NVD figures should never be read as a risk ranking.

Malware volume: one vendor's users

Kaspersky reported fewer new malicious or unwanted installation packages on Android in 2025 than in 2024, with banking trojans the fast-growing part and adware the main part of detections[S5]. The company separately reported that banking-trojan attacks on Android rose in 2025[S6]. These numbers describe people who run Kaspersky’s mobile products and opted in to its network.

Google reports a different measure from a different place: a very large number of new malicious apps identified outside Google Play in 2025 by Play Protect, which Google says scans apps at very large scale every day[S7]. Both figures are vendor self-reports. Neither can be added to the other.

People: stalkerware and notifications

Kaspersky counted the unique users affected by stalkerware in 2023, a little more than in 2022 and far fewer than in 2019[S8]. It reported a combined figure for 2024 and 2025, not split by year[S9]. These are one vendor’s users, a floor.

Apple says it has notified users in more than 150 countries since 2021 and that the vast majority of users will never be targeted[S10]. A wave reported in August 2026 reached users in 110 countries, with no user count given[S11]. In the Pegasus Project, Amnesty’s Security Lab examined 67 phones; 37 showed traces and 30 were inconclusive. A phone number on a leaked list was not proof of infection[S12].

Phishing: the channel shift

Phishing is the one place where phones show up as a channel rather than a target. Verizon’s 2026 Data Breach Investigations Report, as summarized by Help Net Security, found a somewhat higher median click rate in phone-centric (voice and text) phishing simulations than for email. The reported rise is relative; in absolute terms it is small, and the authors said they struggled to find companies running such simulations[S15]. The FBI’s Internet Crime Complaint Center recorded 191,561 phishing and spoofing complaints in 2025, the most of any crime type, against 193,407 in 2024[S16]. Complaints are self-reported, and neither source isolates phones.

What no one has measured

We found no public median for how long a mobile compromise goes unnoticed. Mandiant’s global median for 2025, a matter of days or weeks, comes from enterprise incident-response work, not phones[S13]. The one mobile campaign with a primary-source timeline, Operation Triangulation, shows traces from 2019 to 2023[S14]; that is one campaign, not a median. Nor is there an independent measure of the share of apps holding both camera and microphone access, or of how much background traffic is unusual.

Five questions for the next headline number

Who counted, and whose devices were in the sample? What exactly was counted: detections, packages, users or published flaws? Which year does it describe, and when was it published? Has it been revised? What does the source itself say it cannot show?

What this means for examiners

When a client asks how common something is, answer with the source, the year and the limit before the number. When a result is clean, say which evidence was available and for what period. Avoid ranking platforms by catalog entries or vulnerability counts; they reflect disclosure practice and tagging as much as risk. The same discipline applies to our own work: where this article computes a figure from a public file, it says so, gives the date and keeps the method with the production record, so a reader or a reviewer can repeat it.

What the Lab is watching

We will recompute the catalog and database counts on each publication date, and we will note any revision to Google’s totals, as it has revised earlier years upward. We are also watching for a primary dwell-time study of mobile compromise. If one appears, it will close the gap above.