iVerify reports rising iOS spyware infections among ordinary users

What happened

According to a report from the threat hunting firm iVerify, covered by The Record, cybercriminals are increasingly infecting ordinary people with spyware. This is iVerify’s claim as relayed by The Record, and the sources do not show independent verification of the figures.

The details below are all attributed to iVerify or to people quoted by The Record:

• iVerify says it found 1.07 spyware infections per 1,000 consumer scans of its free online checks. For enterprises it reports 0.7 per 1,000 scans, and it attributes the lower rate to enforced patching, on-device detection and network security controls. Co-founder Rocky Cole declined to give the exact number of consumer devices tested, saying only that hundreds of thousands were scanned. The Record
• The report says about 75% of detections involved criminal actors using the Coruna or DarkSword exploit kits, and the other 25% involved mercenary spyware such as Pegasus. The Record
• The Record describes DarkSword as a JavaScript-based iOS exploit kit and spyware framework first made public in March. It says visiting a compromised website can trigger infection without a click. Coruna is also delivered through malicious websites that trigger WebKit and kernel vulnerabilities. The Record
• The Record reports that Coruna has been used to steal cryptocurrency from over 42,000 iOS devices via fake Chinese-language financial websites. It says Google Threat Intelligence Group first discovered Coruna in February 2025, and that a former L3Harris Trenchant executive who pleaded guilty to selling stolen exploits was sentenced to seven years in prison in February 2026. The Record
• According to the report, owners of devices infected with DarkSword and Coruna did not receive Apple threat notifications. It also says Android faces a similar shift, with cheap turnkey spyware kits. The Record

Not confirmed in the sources: the exact number of devices scanned, independent validation of the infection rates, the CVE identifiers or patch versions involved, and any response from Apple.

Am I affected?

The sources give no product versions, CVE identifiers or indicators of compromise, so a version-based check is not confirmed as possible.

According to iVerify, as relayed by The Record:

• The reported activity targets iPhones (Coruna and DarkSword) and, in a similar shift, Android devices.
• Infections were seen on both consumer and enterprise devices, and many infected enterprise employees were rank and file workers rather than top executives.
• Many infections were used for credential and crypto theft rather than politically driven abuse.

What to do now

1. Update your threat model. Cole says businesses should stop focusing on VIPs and assume everyone in the organization has to tackle this problem. The Record
2. Review enforced patching, on-device detection and network security controls on mobile devices. iVerify attributes its lower enterprise infection rate to these measures. The Record
3. Do not rely on Apple threat notifications alone. The report says owners of infected devices did not receive them (this step is our reading of that claim, not a sourced recommendation).
4. Watch for further reporting. Patch details, CVE identifiers and Apple’s response are not confirmed in the sources.

Update, 10 November 2026

CyberScoop’s separate account of the iVerify report adds the following, all as iVerify’s claims relayed by CyberScoop. We have not seen the report itself.

• iVerify says some Apple Threat Notification cases this year reached people with no public profile or sensitive job, including the children of a city bus driver and a stay at home mom in Ottawa, and a limousine driver in Australia.
• iVerify says the consumer infection rate held relatively steady through 2026 at 1.07 per 1,000 iOS scans.
• Co-founder Rocky Cole argues that for credential theft and resale, an executive’s credentials are not necessarily worth more than those of a system administrator or an average employee. He says enterprise employees most likely to be hit “look much more like the limousine driver than like the CEO.”
• CyberScoop reads the missing notifications for DarkSword and Coruna victims as a sign Apple may be overly focused on nation state threats and well known commercial spyware such as NSO Group’s Pegasus.
• CyberScoop cites the AdFection spyware attacks as the latest example of the trend, saying they could infect anyone visiting a website that carried advertising.

CyberScoop does not give the size or makeup of iVerify’s customer sample, CVE identifiers or a patch.

Sources

• The Record: Cybercriminals are increasingly infecting regular people with spyware