Cybersecurity experts have urged UAE residents to avoid downloading apps sent to them through WhatsApp, Telegram and other unofficial channels, warning that this is one of the most common yet preventable ways malware infiltrates personal devices.

Speaking on the sidelines of GISEC Global 2026, Pushkar Singh, Regional Director for the Middle East and Africa at Protectt.ai, said the UAE has one of the world’s highest volumes of app downloads, making it an attractive target for malware disguised as legitimate applications.

“A trusted source means downloading an app from the Google Play Store on an Android device or from the Apple App Store on an iOS device,” he said.

According to Singh, apps distributed through WhatsApp, Telegram or the dark web are often tampered with, and users may install them without being aware of the risks.

He added that security technologies can detect whether an app has been obtained from an untrusted source or altered, and can prevent it from running even if an unsuspecting employee installs it on a corporate device.

Singh said some apps in circulation have been reverse-engineered and injected with malicious code. His company counters this threat through measures including code obfuscation and runtime protection tools.

“Users should not do this, but organisations must also implement security controls to ensure that even if an unsuspecting user downloads such an app, it cannot run,” he said.

AI Is Fuelling Social Engineering Scams

Singh also warned of a sharp rise in AI-powered social engineering scams, saying voice and video cloning technologies have made impersonation easier for fraudsters.

He cautioned that transactions seemingly authorised during a genuine voice or video call may in fact be carried out by scammers using AI-generated faces or voices.

He also warned against the careless use of VPNs and proxy services without knowing how traffic is routed, noting that traffic interception is another common method used by attackers.

Fintech Growth Makes Security More Critical

Singh said the rapid growth of the fintech sector in the UAE and other Gulf Cooperation Council countries, much of it built on AI-powered platforms, has made the security of digital transactions critical for both individuals and organisations.

He said companies no longer view tools such as automated runtime application protection and AI security as optional, but as essential safeguards, because security breaches can cause both financial losses and reputational damage.

He advised companies not to select security solutions solely on price and to extend protection beyond core applications to mobile phones and AI agents, areas over which organisations often have limited direct control.

“AI offers tremendous benefits and significant productivity gains, but it also has a dark side and can be used to manipulate transactions or create new threats,” Singh said.

AI Threats Outpace Traditional Defences

These concerns reflected the broader message of GISEC Global 2026, where Hadi Anwar, CEO of CPX, told the Emirates News Agency that AI-driven threats were increasing in speed, scale and sophistication, forcing organisations to move beyond traditional defence models.

He identified deepfake-enabled fraud, identity-based attacks and AI-enhanced social engineering as growing threats, alongside concerns such as unsupervised AI use, data leakage and model manipulation.

Anwar said generative AI had transformed security from a purely technical matter into a management and governance issue, requiring stronger oversight throughout the AI lifecycle and tighter protection of digital supply chains that rely on third-party models.

Supply Chain and Phishing Risks Rise

Ashraf Koheil, Group Vice President of Sales for META and ANZ at Group-IB, said GCC countries ranked among the world’s top 10 targets for supply chain attacks in 2025.

He added that phishing attacks targeting the region’s financial services sector accounted for 28.5 per cent of all such attacks across the Middle East and Africa.

According to Koheil, Group-IB’s “Prediction-First” approach relies on continuous monitoring of threat actors, compromised credentials and malicious infrastructure, combining this data with AI-powered analysis to identify threats before they become incidents.

Since 2003, the company has investigated more than 1,600 sophisticated cybercrime cases worldwide. In 2025 alone, it worked with 52 law enforcement agencies in operations that led to 1,809 arrests and the disruption of more than 34,800 malicious infrastructure assets.

Koheil said threats are no longer confined to a company’s internal boundaries but also extend to suppliers, fintech partners and payment service providers, increasing the importance of local cybersecurity expertise and capabilities.