Jamf unveils 2025 Security 360 Report: A strategic look at Mac and mobile security risks
HONG KONG SAR - Media OutReach Newswire - 19 June 2025 - Jamf (NASDAQ: JAMF), the standard in managing and securing Apple at work, today released its Security 360 Report, separated into analyses for mobile and macOS environments. The report spotlights the risks organizations are facing and offers insights for security leaders to consider when protecting their organizations at the user, device, application and network levels.
'Our goal with this research is to inform security leaders about the risks impacting their organizations – whether those risks impact Mac or mobile – and provide tangible recommendations for safeguarding their organizations against increasingly sophisticated attacks,' said Josh Stein, VP of Product Strategy at Jamf. 'Age-old threats like phishing remain extremely prevalent and cannot be overlooked...nor can threats skyrocketing in popularity like infostealers. Jamf remains deeply committed to continuous threat research to not only protect our customers but also contribute valuable insights to the broader security community.'
Threat trends facing mobile environments
For many employees, mobile devices are the sole devices used at work. Regardless of occupation, the modern workplace is about empowering employees to connect from anywhere, at any time and on any device. This requires raising awareness about the most pervasive threats facing mobile devices and taking tangible steps to keep bad actors at bay.
Jamf's mobile device threat analysis is structured into four categories found to be the highest priorities for organizations worldwide.
Mobile phishing
With mobile devices keeping us connected everywhere, attackers' reach continues to expand. Over 12 months, Jamf identified approximately 10 million phishing attacks, discovered that 25% of organizations were impacted by a social engineering attack, and 1 in 10 users clicked on a malicious phishing link. Training programs can be extremely valuable in mitigating phishing attacks, as can adopting a layered approach with zero-trust methodology.
Vulnerability management
Jamf discovered that 32% of organizations operate at least one device with critical vulnerabilities and 55.1% of mobile devices used at work are running on a vulnerable operating system (OS). Both Apple and Google routinely provide security updates to patch known vulnerabilities, and the best way to mitigate damage is to update devices accordingly.
Application risk and malware
Earlier this year, Jamf published research on a Transparency, Consent and Control (TCC) bypass vulnerability affecting iOS devices and published a demonstration of how a 'sideloaded' app (an app from a third-party app store) can infringe on users' privacy. The harsh reality is that using the latest OS is still not enough to protect your organization – good security practices must extend to the application layer as well.
Malware and spyware
High-profile users such as journalists, politicians and diplomats are often targeted by mercenary spyware attacks. Just last year, Apple sent notices of spyware compromise to users in approximately 100 countries. While malware is not as pervasive on mobile devices, when discovered, it is found to be extremely advanced and targeted. Organizations must treat mobile like every other endpoint and avoid getting complacent about the threat of mobile malware.
Threat trends facing macOS environments
What began as a machine for executives and creatives is becoming increasingly ingrained into the daily operations of enterprises across all industries worldwide. The threat landscape for Mac is more diverse than ever, and bad actors are only getting more creative with their attack methodologies. Jamf's Mac threat report analyzes the threat landscape affecting Macs and organizes the findings into three main categories:
Application risk and malware
Jamf discovered that infostealers accounted for 28.36% of all Mac malware Jamf examined, skyrocketing from accounting for just 0.25% in last year's report. Jamf's research is aligned with these findings. Employees of organizations in high-profile industries (like crypto), must remain vigilant from both a training and security tool standpoint.
Vulnerability management
Jamf Threat Labs has dispelled the myth that Mac is invincible multiple times, including just last year when the team discovered a vulnerability in Gatekeeper, a crucial component blocking apps downloaded from the internet that don't have a valid developer ID. Having the right controls and training is crucial for mitigating risks caused by vulnerabilities on macOS.
Social engineering
With Macs becoming more common at work, the attack surface continues to expand. Phishing is typically thought of as email-specific, which is far from the truth. In fact, Jamf Threat Labs published research discussing a campaign from the Democratic People's Republic of Korea (DPRK) that uses LinkedIn messaging as an initial lure. Training employees in the various forms of phishing that can impact the Mac environment is critical for avoiding fallout.
Methodology
Jamf examined 1.4 million devices protected by Jamf. The analysis was carried out in the first quarter of 2025, revisiting the prior 12-month period and spanning globally across 90 countries and multiple platforms – specifically, iOS and iPadOS and Android devices for mobile as well as Macs. The analysis in this report is informed by Jamf's Threat Intelligence, a broad collection of insights that are derived from original threat research, real-world usage metrics, along with news analysis and data feeds.
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Malay Mail
2 days ago
- Malay Mail
Texas keeps porn age-check law after US Supreme Court rejects free speech challenge in major online content ruling
WASHINGTON, June 28 — The US Supreme Court yesterday upheld a Texas law requiring pornographic websites to verify visitors' ages, rejecting arguments that this violates free speech and boosting efforts to protect children from online sexual content. The court's decision will impact a raft of similar laws nationwide and could set the direction for internet speech regulation as concerns about the impact of digital life on society grow. Texas is one of about 20 US states to institute checks that porn viewers are over 18, which critics argue violate First Amendment free speech rights. Britain and Germany also enforce age-related access restrictions to adult websites, while a similar policy in France was blocked by the courts a week ago. US companies like Meta, meanwhile, are lobbying Washington lawmakers for age-based verification to be carried out by smartphone giants Apple and Google on their app stores. The Texas law was passed in 2023 by the state's Republican-majority legislature but was initially blocked after a challenge by an adult entertainment industry trade association. A federal district court sided with the trade group, the Free Speech Coalition, saying the law restricted adults' access to constitutionally protected content. But a conservative-dominated appeals court upheld the age verification requirement, prompting the pornography trade group to take its case to the Supreme Court, where conservatives have a 6-3 supermajority. Under the law, companies that fail to properly verify users' ages face fines up to $10,000 per day and up to $250,000 if a child is exposed to pornographic content as a result. To protect privacy, the websites aren't allowed to retain any identifying information obtained from users when verifying ages, and doing so could cost companies $10,000 daily in fines. During arguments in January before the Supreme Court, a lawyer representing the Free Speech Coalition said the law was 'overly burdensome' and that its goal could be accomplished using content filtering programs. But Justice Amy Coney Barrett, the mother of seven children, took issue with the efficacy of content filtering, saying that from personal experience as a parent, such programs were difficult to maintain across the many types of devices used by kids. Barrett also asked the lawyer to explain why requesting age verification online is any different than doing so at a movie theater that displays pornographic movies. The lawyer for the Free Speech Coalition — which includes the popular website Pornhub that has blocked all access in some states with age verification laws — said online verification was different as it leaves a 'permanent record' that could be a target for hackers. During the court's hearing of the case in January, Chief Justice John Roberts and Justice Clarence Thomas, both Republican appointees, seemed to suggest that advances in technology might justify reviewing online free speech cases. In 1997, the Supreme Court struck down, in an overwhelming 7-2 decision, a federal online age-verification law in what became a landmark free speech case that set a major precedent for the internet age. — AFP
The Star
2 days ago
- The Star
How Steve Jobs would have reacted to Apple's WWDC liquid glass redesign
There are two Steve Jobs keynotes that stand out in my memory more than any other. The first, of course, is the moment he introduced the iPhone in 2007. The entire keynote was a master class in storytelling, engineering, and showmanship. But my favourite part was when Jobs, in the middle of a live demo, prank called a Starbucks and calmly said he wanted to order 4,000 lattes to go. Then he quickly added, 'Just kidding,' and hung up the call. It was a small thing, but it was unforgettable. It was unexpected. It was … fun. But there's another moment that sticks with me. It's less iconic, but only because on the scale of the iPhone, everything is less iconic. It was, however, just as telling about how Jobs thinks about products and how to talk about them. It was 2000, when Jobs introduced Mac OS X's Aqua interface. The new design was fluid, full of gradients and transparency. It was colorful and reflective – almost glossy. It looked unlike anything else at the time. And when Jobs talked about it, he said something that defined Apple's relationship with design for the next two decades: 'One of the design goals was that when you saw it, you wanted to lick it.' Then he paused and licked his lips. I often think about the fact that the goal of designing a piece of software that millions of people would use was as much about how it made people feel as it was about being useful. Obviously, it had to be useful, but it also had to be fun. It had to be delightful. This brings me to this year's WWDC. Apple announced a major redesign of all its software platforms with what it's calling 'Liquid Glass.' According to Alan Dye, Apple's VP of human interface design, the goal was to give the system 'depth, vibrancy, and a new level of expression.' It's a very different look, especially on the iPhone – but there are real changes on the Mac as well. But the thing I keep thinking about is: Where's the fun? The keynote was impressive. It was polished. It was efficient. But it didn't quite feel joyful. It didn't feel like Apple was showing off something it loved. It felt like Apple was explaining something it had to get right. Dye used a lot of words to explain how the company studied the properties of glass and how it reflects and refracts light. The thing is, I think it would have been fine if he'd just said Apple thinks it's really cool. I've heard and read critics saying that Jobs would roll over in his grave if he saw the new interface design. That's the kind of thing that's easy to say for views, but I don't think it's true at all. First, the new design is still an early beta. Yes, there are things that don't work from a design perspective – but it's far too early to pass judgment. I have confidence that Apple will fix them as it gets closer to September when it ships them to the public. My point isn't that Jobs wouldn't have liked what Apple is doing with Liquid Design. My point is that he would have had a lot more fun with it than the company seems to be having. Perhaps it's harder now than in 2000. Perhaps that's because Apple is under intense pressure, now more than ever. It's been a year since Apple teased the arrival of a smarter Siri and its broader vision for AI, now branded 'Apple Intelligence.' Expectations are high, especially as it seems the competition is delivering on Apple's promises with more speed and consistency than Apple itself. But the Liquid Glass redesign – what should have been the most obviously delightful part – felt strangely sterile. During the Aqua introduction, Jobs said that 'when you design a new user interface, you have to start off humbly. You have to start off saying, 'What are the simplest elements in it? What does a button look like?' And you spend months working on a button.' The implication was that even something as small as a button can carry emotion, weight, and personality. I miss the company that wasn't afraid to get weird. To call a design 'lickable.' To order 4,000 lattes from the stage. I'm not saying Apple needs to recreate Steve Jobs's persona. That would be impossible – and probably a bad idea. But I do think it needs to rediscover a little of that energy. That sense of play. That design isn't just functional, or even beautiful. It's emotional. It's fun. A user interface doesn't have to be revolutionary to be memorable. It just has to make you feel something. Better yet if that feeling is: 'I kinda want to lick this.' – Inc./Tribune News Service
The Star
2 days ago
- The Star
Balancing privacy, safety and accountability
AS of Jan 1, Malaysia recorded 25.1 million social media users, making it one of the most connected populations in the region. Most of these users voluntarily share personal data far beyond what is needed, for example, posting locations, preferences, routines and sometimes even sensitive information like their children's school details, vaccination records, or holiday plans. Ironically, while there is widespread concern over government or institutional data collection, little attention is paid to how private corporations such as Meta (Facebook), ByteDance (TikTok) and X (formerly Twitter) actively profile users for commercial gain. Facebook once claimed it would never sell user data, yet it infamously shared user data with Cambridge Analytica. This incident became a major scandal in global privacy discussions and involved not just basic data, but detailed personal information used for targeted political manipulation. If there is real concern about data being misused, then platforms that profit from mass data harvesting should be examined with equal, if not greater, intensity. One of the most overlooked realities in the digital age is this: there is no such thing as a free service. Every time a user signs up for a 'free' app or platform, be it social media, navigation tools, or online games, it is an exchange. Users grant access to their personal data, including their usage patterns, preferences, device details and even contacts, in return for these services. Most people accept the terms and conditions without reading them, unknowingly agreeing to large-scale data collection. Unlike the limited data gathered for national digital services for cybersecurity or to improve performance, tech giants build multi-billion-dollar empires on the back of detailed personal data profiles. This raises the question: why is there so much concern when a government programme or national platform transparently collects data for operational or protective purposes, while the daily exploitation by foreign platforms goes largely unchecked? Tech giants like Google and Apple have perfected the art of data collection. Gmail, Google Docs, Google Drive, Apple iCloud, Siri and Google Photos are all part of systems that continuously collect and analyse user data. This includes not just basic data, but actual content like search terms, voice commands, photos, browse history and even location. Apple may advertise itself as being focused on privacy, but even its basic data (such as who you called, when and for how long) is stored. Google, meanwhile, uses user behavior data for advertising, product development and AI training. Is the public truly informed about how much their data powers Google's AI models or Apple's products? More importantly, where is the outrage when these tech companies push updates that make it harder to opt out of data sharing? It is necessary to ensure fairness, ethical governance and consent in all forms of data collection, whether by governments or private companies. Nevertheless, we must avoid one-sided anger. A responsible national policy that uses shared data to detect cybersecurity threats or improve digital services should not be attacked while corporate data collection for profit is ignored. Not only that, data is also crucial in fighting online dangers. Protecting Malaysians in cyberspace is becoming more and more critical as online threats continue to grow. Shared user data plays a key role in the fight against cybercrime, helping to automatically detect scams, fraud and cyberbullying early on. With such incidents on the rise, using data responsibly is essential for public safety. Nevertheless, for such programmes to earn public confidence, the role of government oversight cannot be forgotten. It is vital that the MCMC and all relevant agencies do their part by performing careful checks. They must ensure that any data collected is stored and managed securely according to the highest international standards, making sure strong protections are in place to prevent data breaches. The public's trust depends on this strict oversight and accountability. Instead of debating endlessly, Malaysians should support the government's efforts to build a convenient and safer digital environment for all. Malaysians should answer the question of whether the need to protect the safety of Malaysians is more important than unproven claims of data privacy breaches. Prof Dr Selvakumar Manickam Universiti Sains Malaysia Cybersecurity Research Center director
