KHALEEJ TIMES : UAE residents have been asked to stop downloading mobile applications shared through WhatsApp, Telegram and other informal channels, warning that the practice is one of the most common — and most avoidable — routes through which malware reaches personal devices.

Speaking on the sidelines of the Gisec Global 2026, Pushkar Singh, country head for the Middle East and Africa at Protectt.AI, said the UAE is among the regions with the highest volume of app downloads globally, which makes it a prime target for malicious software disguised as legitimate applications. 

“An authentic source means if there is a mobile application on an Android device, it should be downloaded from the Play Store, and if it is an iOS device, from the App Store,” Singh said.

Applications circulated through WhatsApp, Telegram or the dark web often had their integrity compromised, he added, without users realising the risk before installing them.

Singh said technology can detect whether an application has been sourced illegitimately or tampered with, and can block it from functioning even when an unaware employee has already installed it on a corporate device.

He said some apps in circulation had been “re-engineered” with malicious code injected into them – a threat his firm addresses through code obfuscation and runtime protection tools.

“As a user, they should not be doing it. But enterprises need to build security controls so that even if an unaware user has downloaded it, it should not work,” he said.

AI supercharging social engineering scams
Beyond malicious apps, Singh flagged a sharp rise in AI-enabled social engineering, pointing to how voice and video duplication technology has made impersonation scams easier to pull off. Transactions authorised during what appears to be a genuine video or voice call could, in fact, be the work of fraudsters using AI-generated likenesses, he warned.

He also cautioned against the casual use of VPNs and proxy services without understanding where traffic is being routed, noting that intercepted traffic is another common vector attackers exploit.

Fintech boom raises the stakes
Singh said the UAE and wider GCC’s fast-growing fintech sector — much of it built on AI-driven platforms — has made securing digital transactions, whether peer-to-peer or enterprise-level, increasingly critical.

On enterprise security budgets, Singh said companies are increasingly treating tools such as runtime application self-protection and AI security as “must-have,” not “good-to-have,” given the reputational as well as financial fallout from breaches.

He advised firms to select security solutions based on fit rather than cost alone, extending protection beyond core applications to mobile endpoints and AI agents where enterprises often have limited direct control.

“AI is a lot beneficial — it is creating immense efficiencies. But at the same time, there is a darker side, where AI is leveraged to manipulate transactions or create new threat vectors,” Singh said.

AI threats outpacing traditional defences
The concerns echoed a broader message from GISEC Global 2026, where CPX chief executive Hadi Anwar told Wam that AI-powered threats are escalating in speed, scale and sophistication, pushing organisations beyond traditional defensive models.

He cited deepfake-enabled fraud, identity-based attacks and AI-powered social engineering as growing risks, alongside emerging concerns such as ungoverned AI use, data leakage and model manipulation.

Anwar said generative AI has turned security into a business and governance issue, not just a technical one, requiring stronger oversight across the AI lifecycle and tighter protection of digital supply chains reliant on third-party models. He pointed to CPX's Sovereign Resilience Response — combining readiness, protection, automated containment and rapid recovery — as an example of the shift towards proactive, evidence-based security models in the region, with Secure AI, physical security and OT security seeing the strongest demand at this year's event.

Rising supply-chain and phishing risks
Ashraf Koheil, Vice President of Sales for Meta and ANZ at Group-IB, said that GCC countries ranked among the world's top 10 targets for supply-chain attacks in 2025, while phishing attacks targeting the region’s financial services sector accounted for 28.5 per cent of all such attacks across the Middle East and Africa.

Koheil said Group-IB's "Prediction-First" approach relies on continuously monitoring threat actors, compromised credentials and malicious infrastructure, correlating this intelligence with AI analysis to flag risks before they escalate into incidents. The company has completed more than 1,600 investigations into high-tech crime globally since 2003, and in 2025 alone supported 52 law-enforcement agencies worldwide in operations that led to 1,809 arrests and the dismantling of over 34,800 pieces of malicious infrastructure.

He said threats increasingly extend beyond a company’s own perimeter to suppliers, fintech partners and payment providers, underlining the value of local expertise.