Are Phishing and Infostealers on the Rise for Apple Devices?

Understanding the Latest Security Trends for Mobile and Mac Devices: Insights from Jamf’s Security 360 Report

In a rapidly evolving digital landscape, the importance of cybersecurity cannot be overstated. Jamf, a leader in Apple device management, has recently released its Security 360 Report, which uncovers significant security trends and risks affecting mobile and Mac devices in organizational environments worldwide. This comprehensive analysis shines a spotlight on the persistent and emerging threats that organizations face, particularly in the realms of phishing, infostealers, and operating system vulnerabilities. By understanding these risks, security professionals can take proactive measures to safeguard their enterprises.

As organizations increasingly rely on mobile and Mac devices for daily operations, the findings of this report serve as a crucial guide for security leaders. Josh Stein, Vice President of Product Strategy at Jamf, emphasizes the objective of the research: to equip security professionals with insights into the challenges posed by both longstanding and emerging threats. With a focus on practical recommendations, the report aims to enhance the security posture of organizations against increasingly sophisticated attacks.

Mobile Threat Landscape: An In-Depth Analysis

The report highlights that mobile devices are often the primary tools employees use to access work resources. This reliance underlines the need for robust security measures across various threat vectors. Jamf categorizes its analysis of mobile device threats into four key areas:

• Phishing: This remains the most prevalent threat, with around 10 million phishing attacks reported in the past year. The data reveals that 25% of organizations faced a social engineering incident, and one in ten users clicked on a malicious link.
• Vulnerability Management: A staggering 32% of organizations had at least one device with critical vulnerabilities, while 55.1% of mobile devices were running on outdated operating systems.
• Application Risk and Malware: The report emphasizes the need for security controls that go beyond merely updating operating systems.
• Spyware: Although less frequent, advanced malware poses significant risks, particularly to high-profile individuals.

Phishing: A Persistent Threat

Phishing attacks continue to be a major concern for organizations, given their ability to compromise sensitive information with relative ease. The report's statistics are alarming:

• Approximately 10 million phishing attempts were recorded in the past year.
• One in ten users clicked on a malicious link, indicating a substantial need for security training.

To combat these risks, the report recommends implementing security training programs and adopting layered, zero-trust security models. By fostering a culture of cybersecurity awareness, organizations can significantly reduce the likelihood of falling victim to phishing attacks.

Vulnerability Management: The Need for Timely Updates

The analysis found that 32% of organizations had at least one device with critical vulnerabilities, highlighting the importance of regular updates. Here are some key takeaways:

• 55.1% of mobile devices were found to be running on vulnerable operating systems.
• Timely updates from manufacturers like Apple and Google are essential for patching known vulnerabilities.

Organizations must prioritize timely updates and patches to fortify their defenses against potential threats.

Application Risk and Advanced Malware

Application risk is another significant area of concern. The report refers to a previous identification of a Transparency, Consent, and Control (TCC) bypass flaw on iOS, illustrating how side-loaded apps can compromise user privacy. Additionally, advanced malware and spyware pose substantial risks, particularly to high-profile individuals such as journalists and diplomats. Apple has even sent compromise notifications to users in around 100 countries, underscoring the seriousness of these threats.

Organizations are encouraged to treat mobile devices with the same level of security as other endpoints within the enterprise environment. This approach will help mitigate the risks associated with advanced malware and spyware.

Threats to macOS: Evolving Risks in the Workplace

Mac devices have transitioned from being niche tools for executives and creatives to becoming common fixtures in diverse enterprise environments. This shift has broadened the attack surface and led to an increase in the variety of threats targeting the macOS platform. Jamf’s report outlines three primary areas of concern for macOS security:

• Application Risk and Malware: Infostealers have emerged as the dominant form of malware on Macs, accounting for 28.36% of all analyzed Mac malware. Employees in sectors like cryptocurrency are particularly vulnerable.
• Vulnerability Management: Despite perceptions of invulnerability, macOS still faces vulnerabilities that require effective controls and ongoing employee training.
• Social Engineering: The widespread adoption of Macs in workplaces has made them a target for social engineering attacks, often initiated through professional social media platforms.

Infostealers: A Growing Threat

The report identifies infostealers as a significant concern for Mac users. The statistic that infostealers now account for 28.36% of all Mac malware is particularly alarming, especially considering the previous year's figure of just 0.25%. Employees in industries that handle sensitive data, such as cryptocurrency, must remain vigilant. The report advocates for ongoing training and robust technological defenses to combat these threats.

Addressing Myths about macOS Security

One of the key messages from the report is the need to dispel myths surrounding macOS security. Many users believe that Macs are inherently secure, but vulnerabilities persist. The report highlights a recently discovered flaw in Gatekeeper, a mechanism designed to prevent unverified apps from being executed. This finding underscores the necessity for both effective technical controls and regular employee training to counteract risks associated with software vulnerabilities.

Social Engineering Tactics Targeting Mac Users

Social engineering threats, including phishing, often exploit the adoption of Macs in the workplace. The report notes that attackers are increasingly using professional social media platforms such as LinkedIn to initiate campaigns, rather than relying solely on traditional email channels. Comprehensive employee training that addresses all forms of phishing relevant to Mac users is imperative to mitigate these risks.

Methodology of the Security 360 Report

The findings presented in the Security 360 Report are based on an analysis of 1.4 million devices protected by Jamf, conducted during the first quarter of 2025. This extensive analysis covered the previous year and included users from 90 countries, spanning multiple mobile and desktop platforms, such as iOS, iPadOS, Android, and macOS devices. The report integrates Jamf's proprietary Threat Intelligence, drawing on original research, device usage metrics, and insights from news and external data feeds.

Conclusion: The Road Ahead for Cybersecurity

As mobile and Mac devices continue to play a pivotal role in organizational operations, understanding the security landscape becomes increasingly crucial. Jamf’s Security 360 Report serves as a comprehensive resource for security professionals, offering valuable insights into the prevalent and emerging threats that organizations must confront. By implementing robust security measures, investing in employee training, and maintaining vigilance against evolving threats, enterprises can strengthen their defenses against cyberattacks.

The insights from this report challenge organizations to rethink their cybersecurity strategies, especially in a climate where threats are becoming more sophisticated. As the digital landscape evolves, so must the strategies employed to protect sensitive information and organizational assets.

Are you prepared to confront the growing cybersecurity challenges within your organization? Embrace the insights from Jamf's Security 360 Report and take proactive steps to enhance your cybersecurity posture. The question remains: how will your organization adapt to stay ahead of these evolving threats?

Frequently Asked Questions

What are the main threats highlighted in Jamf's Security 360 Report?

The report identifies phishing, infostealers, and operating system vulnerabilities as the primary threats affecting mobile and Mac devices.

How prevalent are phishing attacks according to the report?

Jamf reports approximately 10 million phishing attacks over the past year, with 25% of organizations experiencing social engineering incidents.

What should organizations do to mitigate mobile threats?

Organizations are advised to implement security training programs, adopt layered zero-trust security models, and ensure timely updates of operating systems to combat mobile threats effectively.

Why is vulnerability management important for organizations?

Vulnerability management is critical as 32% of organizations have at least one device with critical vulnerabilities, and 55.1% of mobile devices are running on outdated operating systems.

As the digital landscape continues to evolve, how will your organization adapt its cybersecurity strategies to stay ahead of potential threats? #Cybersecurity #Jamf #Security360Report