Security firm S21sec has published its second Smartphone Malware Report. Its main conclusion is clear: We users are not yet fully aware that we no longer carry a “phone”, but a pocket computer exposed to the same threats as a PC. As for platforms, it is surprising that, even when registering iOS more documented vulnerabilities In certain periods, the attackers They bait themselves by creating malware for Android for reasons of scale and distribution model.
The report is based on an incontestable reality: The number of smartphones is growing uncheckedAnd that expansion attracts those who previously designed viruses, Trojans, worms, botnets and other computer pests. Today, creating mobile malware can bring in the same money and notoriety that attack the PC, with a plus: the phone is the central point of contact of identity, finances, social life and work.
However, users we still think we have a phone when in reality we are carrying a minicomputer which also makes calls. For S21sec, the human factor remains the weakest link in the security chain: the comfort usually prevails over good practice, and that's where fraud thrives.
By platform, the report debunks certain stereotypes. iOS is not, by definition, more secure than AndroidIn fact, in one of the periods analyzed 35 serious vulnerabilities were discovered in iOS compared to 6 in AndroidThese flaws could allow criminals to exploit the vulnerability to create malware for iPhones or iPads. However, what the operational reality shows is that there is much more malware for Android than for iOS.
There are several reasons. Even with a very robust base (kernel), Android attracts more attacks because it is more popular, as it happened in the Windows vs. Mac era: it wasn't that Mac was invulnerable, but that attacking Windows yielded more by volume. Another reason is the open nature of Android: It can be rooted, allow the installation of apps other than Google Play and there are alternative stores. Even here, S21sec questions whether the App Store is automatically more secure: the security by darkness makes it difficult to know what malware is designed for iOS and what ends up sneaking into their store.
All the details of the report de S21sec.
The scope of mobile threats
- Dominant malware: The Trojans They concentrate the vast majority of mobile malware (more than 95%).
- Banking and fraud: : Virtually all mobile banking attacks target Android devices, favored by their market share and the possibility of side loading.
- Scams and phishing: campaigns of phishing, smishing and social media scams seek credentials and data.
- Leaks and zero-day: gaps by brute force, insiders or vulnerabilities of day zero exploited before a patch; tools for know if your phone has been hacked help in detection.
- IoT and attack surface: The orchestra telephone wallets, connected home and work, increasing the risk.
iOS vs Android: Security by Design and Operation
iOS (controlled ecosystem): App Store with strict review, default encryption, Sandbox, code signing, and elements such as Secure Enclave, Face ID and Touch ID. Granular permissions and distribution fast and simultaneous updates to compatible devices. In return, the user has less room for customization and difficult to deploy traditional antivirus due to platform restrictions.
Android (openness and diversity): platform open source with a broad ecosystem of manufacturers. Multi-layered security: Google Play Protect analyzes apps, granular permissions, full encryption, biometrics and component upgrade improvements through initiatives such as Project Mainline. In the professional field, there are Android Enterprise (work profiles, fully managed mode) and technologies such as Samsung KnoxThe counterpart is the fragmentation: : patches depend on manufacturers and operators, and the side loading increases the risk if not managed well.
In both systems, the user decisions and IT are decisive: activate updates, review permits, to choose devices with good support and avoiding unknown sources dramatically reduces exposure.
Vulnerability management, zero-days, and the exploit market
The vulnerability market shows that iOS and Android exploits can reach similar prices, which shows that both platforms are viable targets. Advanced campaigns such as those associated with commercial spyware (e.g. Pegasus) or cases investigated as triangulation have shown that, in the face of a zero-day chain, an iPhone can be compromised without interaction. The opacity of the ecosystem can make it difficult for the user to detect it, while in Android the existence of security telemetry and MDM/EDR solutions can bring more visibility capacity in corporate environments.
Both Apple and Google operate rewards programs and react with patches, but the exposure time depends on the speed of adoption: On iOS it is usually uniform; on Android, better on models with support commitment and on the list Android Enterprise Recommended. Although store controls have improved, have been detected fraudulent apps in both markets sporadically, reinforcing the need for prudence.
Good practices for users and companies
- Use only official stores and disables installations from unknown sources.
- Check apps: reviews, permissions, developer and behavior.
- Update system and apps as soon as security patches are available.
- Renew the device when you run out of support and perform a first full backup.
- Enable remote wipe and location for loss or theft.
- Do not avoid corporate policies: MDM protections exist for a reason.
- Strong passwords and password manager; avoid reusing them.
- Multi-factor authentication whenever available.
- Prioritize safety over comfort: less friction, more risk.
- Evaluate VPN and security solutions reputable, especially on Android, for app scanning, anti-phishing and Wi-Fi protection.
Corporate environments and MDM
On iOS, Apple Business Manager and supervision Devices facilitate intervention-free enrollment, Managed Apple IDs, control of profiles and a cycle of updates aligned. On Android, Android Enterprise offers job profilemode fully managed, zero‑touch/Knox Mobile Enrollment and a catalog of recommended devices. In both cases, MDM policies allow encryption, passwords, containers corporate, app control and selective deletion, essential in models BYOD/BYOP.
Advantages and limitations of each platform
Android — Pro: highly configurable and with fine-grained privacy control; broad ecosystem with more options and prices. Against: fragmentation and risk if enabled side loading. Suggestion: ideal if you feel comfortable adjusting security and you choose models with guaranteed support.
iOS — Pro: consistency, reliability and quick patches; strong out-of-the-box security. Cons: not invulnerable, depends on supplier decisions and has less customization. Suggestion: Simple option for a solid security without too much configuration.
The debate is not about invulnerability but about risk management: choose the device well, apply good practice and take advantage of platform tools makes a difference. In practice, iOS and Android can be very sure when used and administered correctly.
