-
Criminals were behind the majority of cases of spyware detected by iVerify in 2026, and their main goal is to steal passwords and crypto.
-
Ordinary people are now falling victim to spyware attacks.
-
To prevent your iPhone from getting infected, don’t skip software updates; download the latest version of iOS.
Criminals were behind most iPhone spyware cases seen this year. This is the chief conclusion of a report the mobile security company iVerify published on November 10.
According to the company, 75% of their spyware detections can be attributed to criminals, not spy agencies. The objective of these criminals was straightforward: to steal credentials and crypto.
Regular people are now on the attack target list
Spyware used to target a narrow crowd journalists, activists, officials but, iVerify says, things have changed. Now, Apple’s threat alerts go to all sorts of people, even those with zero public profile.
In Ottawa, the alerts spread for a city bus driver’s children as well as a stay-at-home mom. Even some people in Australia received warnings, such as a limousine driver. These people aren’t dealing with anything sensitive. So it’s not clear why anyone would be interested in spying on them.
One of iVerify’s co-founders, Rocky Cole, explained it to CyberScoop. Most of the attack attempts they detect happen in mass hacks from criminal groups looking for logins to sell. It means there’s no big difference between the credentials of some high-ranking executive and those of an ordinary worker.
The company cases iVerify flagged involved employees lower in rank than managing directors. According to iVerify, the victims are much closer to limo drivers than CEOs.
The company also pointed out that these broad attacks tend to affect those who don’t update their software and leave executives with less damage because they frequently apply updates.
Two hacking kits drive the surge
Most of these cases trace back to two main hacking kits. Their names are Coruna and DarkSword. Google discovered that Coruna, one of them, comes loaded with 23 different exploits. Experts revealed Coruna on March 3 and DarkSword on March 18.
Spyware sellers and suspected state-backed hackers used them first. And within a week after, another variant of DarkSword was released on GitHub. The criminals utilized the source code to develop new variants of DarkSword. One such variant, named P7, reportedly infected a financial institution employee’s phone.
The kits can pull saved passwords, messages, notes and photos. One Coruna tool also searched phones for the recovery phrases that unlock crypto wallets. Meanwhile, iVerify tested whether AI could modify DarkSword to make it work on the newer iPhones. However, none of the suspected AI attempts worked on the devices it tested.
An ad can start an attack
The delivery method worries experts most. iVerify observed a case in which a user caught a DarkSword variant on their iPhone through an Instagram ad. The user was just scrolling. The spyware didn’t require them clicking on anything.
But the same user later clicked another link and picked up a second version of DarkSword, but from a different hacker group this time. iVerify believes both threat actor groups were after cryptocurrency. According to the researchers, nothing points to a failure on Instagram’s part.
Hackers can target ads strategically. The advertising platforms allow them to choose the phone type, iOS version, locations, and interests. This means that the hacker can target only those ads that the kit can exploit.
iVerify named such targeted attacks “half-click” attacks. There is no need for the user to click anywhere. They just need to browse a website or application that uses ads.
Old web code also provides opportunities for the attackers. Someone re-registered one expired shopping tracking domain in September. Some e-commerce websites still load this code, redirecting their customers to a fake cryptocurrency trading platform. This platform installed the DarkSword malware on iPhones with iOS 18.4.0 to 18.7.2. However, there is no information about the number of infections.
Apple’s alerts missed these cases
iVerify says none of the phones it confirmed were infected with DarkSword or Coruna got an Apple threat alert. Apple says it builds those alerts for people it believes someone targeted one by one with mercenary spyware.
That narrow purpose helps explain the gap. Also, iVerify says Apple sends alerts in batches. As a result, much of the evidence vanishes before a message arrives. So the company says people should not rely on alerts alone. Google has also changed its security notification services, in the first quarter of 2026 shutting down its Dark Web Report tool and ending automatic breach alerts for users.
Some headlines say three in four Apple alerts were criminal. The report is narrower. The 75 percent relates to iVerify detection alone and not every single Apple alert.
The iVerify also detected roughly one infected device out of every 900 consumer iPhone scanning it conducts. This reflects the consumer base that iVerify monitors and not all iPhones.
It has more than tripled since early 2025, but the report didn’t mention the total number of scans. Finally, iVerify is in the business of selling mobile security software.
How to protect your iPhone
The remedy is fairly straightforward. Coruna exploits vulnerabilities in iOS 13 to 17.2.1. DarkSword exploits iOS 18.4 to 18.7. As of March 2023, Google said that iOS 26.3.1 and iOS 18.7.6 patch all the vulnerabilities in DarkSword. The problem is for phones that failed to update themselves.
For the update, go to the Settings app, tap General, and then tap Software Update. For old iPhones unable to run iOS 26, upgrade to the latest version of iOS 18.
Vulnerable phones can also switch to Lockdown Mode. Google recommends this in such cases. An Apple spokesperson has said it would block DarkSword attacks, according to iVerify.
Employers have a role too. iVerify urges companies to require minimum iOS versions on personal phones that staff use for work.
