How Cybercriminals Are Targeting Mobile Users Across South East Asia This Holiday Season

Mishing: The Holiday Phishing Wave

One of the most immediate and widespread threats comes from mishing, i.e. mobile-targeted phishing. Phishing sites tailored for mobile have grown dramatically with 82% of phishing sites examined now specifically targeting mobile devices.

During the 2024 holiday shopping surge, smishing messages and fake delivery notifications masquerading as trusted retailers, courier services or payment platforms increased by as much as fourfold. Attackers employ urgency e.g. “Your package is delayed,” or “Tap here to reschedule delivery” to trick recipients into divulging credentials or installing malicious apps.

For employees using mobile devices for work or personal devices that also access corporate apps, a single click can mean leaking enterprise credentials, bypassing MFA, or enabling broader network compromise. In short, mishing is no longer a consumer-only problem.

Malware Targeting Shopping & Payment Apps

Traditionally, mobile banking trojans focused on banks, but the landscape is shifting. Zimperium’s report shows that malware authors are now targeting shopping and payment apps too, turning consumers’ holiday-shopping convenience into a lucrative attack surface.

These attacks commonly use overlay techniques and abuse accessibility permissions to hijack login screens, capture payment credentials or intercept one-time passwords (OTPs). Digital wallets, instead of just banking apps, are now in scope.

Beyond direct malware, Zimperium notes that counterfeit retail apps, often distributed via third-party stores, fake update prompts, or mishing links, contribute heavily to the risk. Their 2025 dataset identified over 120,000 fake mobile apps, of which 65% impersonate retail or financial brands.

For enterprises with staff purchasing (or even just browsing) holiday-related apps on BYOD or corporate devices, the exposure is very real. Payment data theft, credential reuse for corporate logins, and latent backdoors pose major business threats.

Retail App Vulnerabilities & Supply-Chain Risks

Even legitimate retail apps are not off the hook. The report highlights a variety of systemic flaws: misconfigured SDKs, hardcoded private keys, and vulnerable third-party libraries, all of which can be exploited for remote code execution or data exfiltration.

In many cases, these flaws stem from poor app-development hygiene or weak security controls in the supply chain. During a holiday-driven surge of downloads and new installs, such vulnerabilities become prime ground for attackers.

From an enterprise standpoint, this means that third-party consumer apps, especially those that employees install on their devices, effectively become hidden supply-chain risk vectors. Once compromised, such apps can serve as footholds into enterprise networks or identity systems.

What It Means for South East Asia & Regional Enterprises

South East Asia, with high mobile penetration rates, growing e-commerce adoption and widespread BYOD culture, is particularly exposed. During a holiday surge, everything from shopping apps to courier-tracking tools becomes a potential threat vector.

Many organisations may not treat retail-app security as part of their risk perimeter. Yet as mobile and enterprise ecosystems converge, attackers are increasingly exploiting this overlap. For regional enterprises handling sensitive data or customer information, securing mobile endpoints and applications must be part of a proactive cybersecurity posture.