The walls protecting business networks are disappearing, and the weakest link might be in your pocket or on your desk.
A new report from Zscaler’s ThreatLabz team warns that cyber threats targeting mobile devices, Internet of Things (IoT), and operational technology (OT) systems surged dramatically over the past year, with malware now exploiting everything from Android phones to smart TVs and industrial routers.
The alarming growth in mobile threats: Android malware transactions jumped 67% year-over-year, driven by sophisticated spyware and banking malware campaigns, according to the report. Attackers are increasingly infiltrating the Google Play Store itself — Zscaler identified 239 malicious Android apps downloaded 42 million times, many disguised as productivity tools used in hybrid work environments.
Manufacturing, energy, retail, and healthcare sectors were the most targeted. Attacks against the energy industry rose 387%, while the healthcare sector saw a 224% increase, underscoring the expanding threat to critical infrastructure and sensitive data.
IoT devices are the hidden attack surface: Zscaler’s researchers also found that routers made up more than 75% of all IoT attacks, primarily through command injection vulnerabilities. The report notes that botnets powered by Mirai, Mozi, and Gafgyt malware families accounted for three-quarters of all malicious IoT payloads globally.
Even “benign” devices such as smart TVs, data collection terminals, and payment kiosks are being used as gateways for attackers. Over half of IoT traffic routed to China and Russia originated from these types of devices, raising serious concerns about data exfiltration and surveillance.
Why it matters: For credit and collection professionals, many of whom rely on mobile phones, tablets, and connected systems to manage payments and consumer data, these findings are a wake-up call. Cybercriminals no longer need to breach a server to cause damage; an infected phone, unsecured router, or smart terminal can be just as effective a doorway.
The report concludes that organizations should adopt Zero Trust architectures, deploy AI-driven threat detection, and segment IoT and mobile devices from critical systems. As Zscaler puts it, mobile and IoT are no longer peripheral technologies; they’re core business tools, and they’re under attack.
