Mobile Malware · Malware Basics · Lesson 4 of 5

Who Gets Targeted

Mass campaigns, targeted attacks and regional focus, plus what protects most people.

Mass campaigns vs targeted attacks

Before an analyst digs into a sample, they ask a simple question: was this aimed at everyone, or at someone?

A mass campaign tries to reach as many phones as possible and profits from a small percentage of them. FluBot's parcel texts, Bread's billing apps and the SMS stealer campaign from the last lesson are all mass campaigns. The attackers don't care who you are. They care that there are lots of you. Their tools are cheap: lures, fake apps and tricking people into granting permissions. They rarely need a software flaw, because the victim does the installing.

A targeted attack is aimed at particular people, chosen in advance. The best-known examples are the mercenary spyware attacks you studied in iOS Internals, like Pegasus, which can use zero-click exploits. Google's Threat Analysis Group says commercial spyware is typically used against high-risk users such as journalists, human rights defenders, dissidents and opposition politicians. It also reported that most of the zero-day exploits it found being used against phones in 2023 were linked to commercial surveillance vendors. A zero-day is a flaw the vendor didn't know about yet, so no fix exists when it's first used.

The two kinds look different during analysis too. Mass malware is noisy: thousands of near-identical samples, shared servers, copied code. Targeted spyware is quiet: few samples, careful cleanup, and often found only because a victim asked researchers such as Citizen Lab or Amnesty's Security Lab to check their phone.

Keep the odds in view. Because zero-click chains are expensive and get patched once discovered, they are spent on a very small number of people. For almost everyone, the realistic threat is a mass campaign, and that's good news, because mass campaigns are the ones simple habits stop.

Regional focus, and what protects most people

Even mass campaigns aren't truly random. Many banking trojans carry a target list: the package names of the specific banking, payment and crypto apps they watch for. When one of those apps opens, the trojan shows the matching fake screen. Because each fake screen has to be built for a particular bank, criminals focus on countries where they can cash out.

ThreatFabric's reporting on Anatsa shows this clearly. Earlier campaigns focused on banks in the UK and the DACH region (Germany, Austria and Switzerland). In July 2025, ThreatFabric described at least the third Anatsa campaign aimed at the US and Canada, delivered by a file reader app on Google Play that passed 50,000 downloads before removal. About six weeks after launch, an update pulled in Anatsa disguised as a "PDF Update". Other threats have their own geography. Google's 2018 report said SMS fraud apps mainly targeted Thailand, Malaysia, the UAE, Egypt and Iraq, and that in India many harmful apps came pre-installed on cheap devices or through untrustworthy update services.

So what protects most people? The same few habits, because they break the steps mass campaigns rely on:

• Install from official stores. Google's numbers showed sideloading devices were affected about eight times as often.
• Keep Play Protect on, and take its warnings seriously.
• Update the system and apps, which closes the flaws attackers use and brings newer protections like restricted settings.
• Buy certified devices from known brands, since schemes like BADBOX lived on uncertified hardware.
• Question powerful permissions like accessibility, notification access and SMS.

None of these stop a determined government with a zero-day, which is why high-risk people get extra tools like Lockdown Mode. For everyone else, they cover the vast majority of real attacks.