In 2025, the ENISA Threat Landscape report ranked mobile as the leading attack vector, accounting for 42% of threats. The 2026 edition focuses on espionage, and once again, many cases involve the smartphone. Commercial spyware, hijacked messaging apps... these examples show that mobile threat vectors keep evolving.
Commercial spyware: businesses are targets too
The public sector is the most targeted by espionage. According to ENISA, this sector is a prime target because it provides access to strategic data on political positions, foreign relations, defence and security. Nearly three in ten espionage cases recorded in Europe target this sector (29.4%).
Many of these espionage cases go through mobile devices. A European government official was infected with the Pegasus spyware, and the Graphite spyware targeted European journalists and activists via WhatsApp and then iMessage.
The report also mentions DCHSpy, an Android spyware whose new version was used by the Iran-linked group MuddyWater in the context of the Twelve-Day War between Israel and Iran.
But mobile espionage is not limited to the public sector. Commercial spyware, intrusion tools developed by private companies and sold to governments, also affects the business world. Pegasus infections were identified in the Czech Republic, Poland and Spain among logistics and finance professionals. ENISA also reports that the Graphite spyware was allegedly used against a banking executive.
When a professional’s phone is compromised, their messages, documents and access to work tools are exposed, and with them, the company’s data.
Messaging apps hijacked to gain targets’ trust
ENISA highlights another notable trend: the growing abuse of messaging applications. Large-scale campaigns have used Signal or WhatsApp to establish personalised contact with their targets.
In March 2026, the FBI and CISA warned of a campaign by groups linked to Russian intelligence targeting the messaging accounts of government officials and journalists, including on Signal. The attackers posed as the app’s support team and pushed victims to scan a QR code or approve the linking of a new device, so they could then read their messages. Another phishing campaign, in May 2026, targeted Signal backup recovery keys.
In its conclusion, the ENISA Threat Landscape 2026 report describes social engineering that increasingly relies on these trusted communication platforms. No spyware is needed to access sensitive conversations: a message that looks legitimate can be enough. And these campaigns are not isolated. A work device receives an average of 288 phishing attempts per year, and 45% of users click on the links they receive.
Mobile espionage: four recommendations to limit the risk
To limit the risk of mobile attacks, the FBI and CISA, as well as Google, recommend several practices:
- Never share a verification code, PIN or recovery key, even with someone claiming to be support.
- Do not scan a QR code or approve the linking of a new device unless you requested it.
- Regularly check the devices linked to messaging apps such as Signal and WhatsApp, and remove any you do not recognise.
- Keep the operating system and apps up to date, as spyware can exploit security vulnerabilities.
These recommendations reduce exposure, but they rely on each user’s vigilance.
How Pradeo protects professional mobile use
As attacks grow increasingly sophisticated, vigilance alone is not enough. Pradeo Mobile Threat Defense secures mobile fleets with real-time protection against all threat vectors.
Pradeo’s mobile fleet protection solution:
- Detects and blocks malicious applications, as well as intrusive applications that access data unrelated to their declared purpose
- Analyses links received by SMS, email, messaging apps or QR code to block phishing attempts
- Protects against network threats and verifies the integrity of mobile devices
Pradeo also enables organisations to stay in control of their mobile data, thanks to a technology entirely designed and hosted in Europe, beyond the reach of extraterritorial legislation.
