Android malware NotCompatible infects 20K a day, according to mobile security company Lookout
Malicious Software Said to Spread on Android Phones — For years security researchers have warned that it was only a matter of time before nasty digital scourges like malicious software and spam would hit smartphones.
Context & Ripple Effects
Lookout's finding that NotCompatible is infecting roughly 20,000 Android devices a day is the latest data point in a threat curve the firm itself has been charting for years — its 2011 report already flagged a sharp six-month jump in Android malware, and coverage since has consistently shown mobile malware concentrating on Android rather than iOS. The pattern matured through 2013, when researchers documented that mobile malware growth was effectively an Android-only phenomenon and exposed a large-scale Russian Android malware industry operating at commercial scale.
First-order effects
- Roughly 20,000 additional Android users per day are having their devices conscripted into NotCompatible's botnet, turning personal handsets into proxies for relayed traffic and fraud.
- Lookout gains a marquee detection case that validates its mobile-security positioning, while carriers and enterprises face immediate pressure to scan or block infected devices on their networks.
Second-order effects
- Sustained infection rates push Google toward harder platform-side controls — faster security patching, app vetting, and remote kill switches — because endpoint antivirus alone demonstrably can't keep pace.
- The economics on display here (device rental as a service) foreshadow the ad-fraud monetization later seen when a Chinese ad firm was found to have infected over 10 million Android devices for roughly $300K a month in fraudulent revenue, signaling to criminals that mobile botnets are a profitable product line.
Third-order effects
- If the trajectory holds — infections grew about 25% in 2014 to around 16 million devices, per one industry tally of the year's mobile malware surge — smartphones become a primary attack surface requiring the same regulatory and enterprise-grade defense apparatus desktops eventually got.
- The open-distribution model of Android becomes structurally bifurcated: a locked-down default experience for most users versus a riskier sideloading tier, with security posture becoming a competitive differentiator between mobile ecosystems.
The trend: Mobile malware is industrializing from opportunistic scams into persistent, monetized botnet infrastructure, forcing platform owners to absorb security responsibilities they originally left to users.