Sophisticated iPhone spyware once reserved for government surveillance is now being used by cybercriminals against ordinary users, and a new security report finds that criminal attacks account for the majority of detections.
The findings come from mobile security company iVerify’s 2026 Advanced Mobile Threat Report, released on November 10. The researchers found 1.07 spyware infections per 1,000 consumer iOS scans, or about one in 900, while the rate dropped to 0.7 in 1,000 when corporate devices were included.
The figures reflect iVerify users, not the global iPhone population. Its consumer base has more than tripled since the start of 2025, although the report does not reveal total scans or infections.
The biggest change is who is targeted. Every corporate infection linked to a criminal campaign involved a rank-and-file employee, not a high-profile executive.
Leaked iPhone exploits are giving criminals new opportunities
Much of the change stems from two iOS exploit kits known as Coruna and DarkSword, which security researchers made public in March 2026.
Google’s Threat Intelligence Group identified Coruna as a collection of 23 exploits organized into five targeted attack chains from iOS 13 to iOS 17.2.1. During 2025, researchers observed its use by a surveillance provider’s client, followed by a suspected Russian spy group targeting Ukrainian websites.
The same toolkit later appeared in widespread attacks carried out by a financially motivated group in China. Google was unable to establish exactly how Coruña passed between these operators, but its research showed how sophisticated exploitation techniques could spread beyond their original users.
DarkSword followed a similar trajectory. Researchers from Google, Lookout and iVerify revealed the exploit chain on March 18 after identifying its use by surveillance vendors and alleged state-sponsored entities.
The toolkit targeted iPhones running iOS 18.4 and iOS 18.7, exploiting six vulnerabilities to compromise devices and extract sensitive information. Apple addressed these vulnerabilities through subsequent security updates, with Google confirming that all six had been fixed by iOS 26.3.
Both toolkits originally targeted specific older iOS versions, making software updates an important defense. The attacks documented in the report do not demonstrate that the same exploit chains can compromise fully updated iPhones.
The subsequent release of the DarkSword code gave criminals a starting point to develop their own variants without having to discover every vulnerability themselves.
iVerify has since identified modified versions capable of collecting additional passwords, messages, photographs and cryptocurrency wallet information.
Malicious ads can infect vulnerable iPhones without a click
One of iVerify’s most revealing cases involved an ordinary person who suffered two separate DarkSword attacks while browsing online. According to the company’s telemetry data, the first attack began when a malicious advertisement was loaded during a browsing session on Instagram.
The person didn’t click on the ad, but the exploit still started working on the vulnerable device.
A second attack occurred later, after the same person followed a link. Researchers identified a different variant of DarkSword associated with a different threat actor, although both attacks appeared intended to steal cryptocurrency.
The technique is known as a half-click attack because the malicious code can begin execution when an advertisement loads, without requiring the victim to interact with it.
Ad networks allow criminals to narrow their targets using details such as device type, iOS version, location and interests. Attackers can use that information to deliver specific exploits to iPhones running vulnerable software.
The approach combines the reach of online advertising with the ability to target specific vulnerabilities. Someone browsing a legitimate website or scrolling through social media could suffer an attack without downloading anything or visiting a suspicious page.
Criminals have also taken control of legitimate websites through abandoned tracking scripts. In October, researchers discovered a campaign that used an expired analytics domain to redirect visitors to thousands of online stores to malicious servers that distributed DarkSword and Coruna.
Victims didn’t need to visit a fraudulent store because the compromised code was already embedded in otherwise legitimate websites.
App Store protections are not completely immune
The report also highlights FomoPeek, a cryptocurrency tracking app that contained an exploitative toolkit hidden in versions distributed through Apple’s App Store in September. Security researchers from SlowMist and OKX found malicious components in versions 1.1 and 1.2.
The toolkit could exploit iOS vulnerabilities, escape the app sandbox, and access data belonging to other apps.
The affected versions appeared on September 9 and 12, before an update removed the malicious components on September 17. SlowMist’s investigation traced approximately $580,000 in stolen USDT to a cryptocurrency address associated with the operation.
The researchers confirmed the toolkit’s ability to collect application data in a controlled environment, including information from Apple Notes. Their findings do not establish that every supported exploit was successful or that every targeted cryptocurrency wallet was compromised.
FomoPeek is a documented case rather than evidence of widespread App Store exploitation. However, it shows that Apple’s review process cannot guarantee that every approved app is free of malicious code.
Apple’s threat notifications don’t cover every attack
Detecting a successful compromise presents another problem because newer spyware variants can erase evidence before security researchers have an opportunity to investigate. DarkSword can collect stored credentials and other information without maintaining a persistent infection.
Newer variants also remove additional logs and working files, making it more difficult to reconstruct an attack once the malware has finished executing.
A compromised work iPhone could expose credentials for work email, messaging platforms and other services. Criminals could then use those credentials to log in to accounts external to the infected device.
iVerify reports that none of the devices confirmed to be infected with DarkSword or Coruna have received a threat notification from Apple.
Apple’s alert system, however, has a narrower purpose. The company says its notifications are designed for people believed to have been individually targeted by mercenary spyware, typically because of their identity or activity.
The absence of a warning therefore does not prove that Apple’s system has not achieved its intended purpose, nor should users interpret silence as evidence that their device has not been compromised.
The report warns that artificial intelligence is accelerating the development of exploits, although iVerify tests found limits to its effectiveness. Researchers have looked at suspected AI-assisted attempts to adapt DarkSword to newer iOS versions, but none have successfully exploited the tested devices.
Keeping iOS updated remains one of the best defenses against these attacks, as security patches close vulnerabilities that criminals continue to exploit. Installing apps from trusted sources also reduces exposure to other forms of malware.
iVerify recommends extending mobile security monitoring beyond executives, particularly when employees use personal phones for work. The company sells mobile tracking products, which is why it has a business interest in recommending continuous monitoring.
The findings don’t mean that every iPhone can be silently compromised. They show how criminals can reuse sophisticated exploits against vulnerable devices, putting everyday users at risk along with traditional surveillance targets.
How to protect your iPhone from spyware
Keeping your iPhone up to date is the most effective defense against the exploit chains documented by iVerify. Open Settings, select General, then Software Update to check for available patches.
You can also enable automatic installation in Automatic Updates so your iPhone receives future fixes without having to manually check.
Download apps only from trusted sources and check the developer before installing unknown software. Apple’s App Store provides security protections, but the FomoPeek incident shows that approved apps are not automatically safe.
Using strong, unique passwords and two-factor authentication also helps protect accounts, although neither can guarantee protection if the device itself is compromised.
People concerned about sophisticated, targeted spyware may want to consider Block Mode, which restricts certain apps, websites, and features to reduce potential attack paths. Apple designed this feature for people who face unusually severe surveillance threats, so most iPhone owners won’t need it.
