Mobile device security for Indian companies: MDM, app allow-lists, linked-device hygiene, the accounts-department phone hack, and practical controls.
Company phones in India are where the business email, the payment approvals and the executive impersonation attempts all meet, and they are usually unmanaged. The baseline is a mobile device management profile with screen lock and encryption enforced, a work profile that separates company data from personal apps, an allow-list for managed apps, blocked installation of unknown executables, and a monthly check of linked devices on messaging apps. The reason is concrete: in October 2026 a Kochi pharmaceutical firm lost Rs 99 lakh after an attacker compromised the accounts department's mobile phone and impersonated the CEO on WhatsApp.
Because they hold everything and are governed by nothing. A company phone in a typical Indian SME carries the business email account, the bank app, the WhatsApp account used for customer queries, the payment approvals, and the contact list of the founders. It also travels, it is shared for personal calls, it updates itself outside the patch window, and it rarely has a management profile at all. That combination is exactly what the Kochi pharmaceutical case exploited: the accounts department's phone was compromised, a number was saved under the CEO's name with the CEO's display picture, and a genuine employee moved Rs 99 lakh on the strength of a WhatsApp conversation. The device was the perimeter, and nobody was watching it.
Six controls, in priority order. Encryption and a strong screen lock, because a lost phone is a data breach with a name on it. A work profile or container, so company mail, files and the banking app are separated from personal installs and can be wiped independently without wiping the person's phone. An app allow-list for managed apps, with sideloading disabled, because the delivery mechanism in India's 2026 self-propagating malware was a .zip containing an .exe and a .dll. Restrictions on clipboard and screenshots for finance and health data where the device supports it. Certificate pinning or per-app VPN for high-value internal applications, so a proxy certificate installed by a user cannot silently intercept them. And a defined patch policy, because an unmanaged device that self-updates is a device whose software state you have never reviewed.
When you link a second device to a messaging account, the account is used there without the primary phone's prompts. The linked device persists independently of your password, and it is the mechanism behind the GhostPairing campaign that CERT-In rates as High severity, in which attackers take over WhatsApp accounts through device-linking pairing codes with no password and no SIM swap. The control is unglamorous and effective: check the linked devices list on a schedule, remove anything you do not recognise, enable the app's two-step verification, set a device-locking PIN, and require that any request to link a device is verified out of band. Indian users report the pairing code to attackers over a call, and a callback to a known number is what prevents that.
Nine areas: device enrolment and profile enforcement, encryption state, screen-lock and biometric configuration, app allow-list and sideloading posture, linked-device hygiene on messaging apps, mobile OS and browser version exposure, data in the clipboard and the notification preview, the certificate trust store, and the mobile-specific application flows including deep links and session handling. AAVETech delivers this as a fixed-price mobile device and application security assessment at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, in 5 to 10 working days with a retest after remediation included, and a written set of MDM policies your team can implement directly.
| Control | Setting | Risk it removes |
|---|---|---|
| Encryption | Hardware-backed, enforced by MDM | Data loss from a stolen device |
| Screen lock | Strong PIN plus biometric | Shoulder surfing and quick access |
| Work profile | Container for company data | Personal app exposure and lateral movement |
| App allow-list | No unknown sideloading | Malware delivered as a .zip with an .exe and .dll |
| Linked devices | Reviewed monthly, 2-step PIN set | Account takeover via pairing codes |
| Patch policy | OS and browser within 30 days | Known exploited mobile vulnerabilities |
Company phones in India are where the business email, the payment approvals and the executive impersonation attempts all meet, and they are usually unmanaged. The baseline is a mobile device management profile with screen lock and encryption enforced, a work profile that separates company data from personal apps, an allow-list for managed apps, blocked installation of unknown executables, and a monthly check of linked devices on messaging apps. The reason is concrete: in October 2026 a Kochi pharmaceutical firm lost Rs 99 lakh after an attacker compromised the accounts department's mobile phone and impersonated the CEO on WhatsApp.
Cloud MDM plans for small fleets are generally affordable per device per month, and the cost of not having one is now measurable: a Kochi pharmaceutical firm lost Rs 99 lakh through a single compromised accounts phone in October 2026. Even a simple enforced profile, screen lock and app allow-list removes most of that exposure.
It is a WhatsApp account takeover campaign using device-linking pairing codes, which CERT-In rates as High severity, and it needs neither a password nor a SIM swap. The controls are enabling two-step verification with a device-locking PIN, reviewing linked devices monthly, and treating any request to share a pairing code as suspicious, verifying it out of band.
Yes, and that is why a work profile matters, because a remote wipe of the work container removes company mail, files and app sessions without destroying the employee's personal phone and without waiting for a return-to-office visit.
The 2026 self-propagating campaign delivered a .zip containing an .exe and a .dll that hijacked the victim's WhatsApp Web session and forwarded itself to contacts. CERT-In's recommended controls are MDM, linked-device hygiene and software restriction policies that block unknown .exe and .dll files from user profile directories, which is precisely what an allow-list and a managed profile deliver.
At AAVETech a fixed-price mobile device and application security assessment runs at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, with a 5 to 10 working day turnaround and a retest included. The output includes MDM policy settings your administrator can apply directly.
Read the full guide on AAVETech: How Do You Secure Company Phones in the Indian Workforce?.
Send us your handset list and messaging app usage and we will return a fixed-price mobile device security assessment with MDM policy settings.
Talk to an analyst about this.