iVerify says criminals, not governments, now cause most of the iPhone spyware it finds

For years, iPhone spyware was something used sparingly by governments against journalists, activists and officials. The mobile security company iVerify says that changed in 2026. Its 2026 Advanced Mobile Threat Report, published November 10, says most of the iPhone infections it detected this year came from criminals using leaked exploit kits, aimed at ordinary people to steal logins and cryptocurrency.

What iVerify measured

iVerify runs a free online check that consumers can use to look for signs of spyware, along with paid tools for companies. Its headline numbers:

• about 1.07 iOS infections per 1,000 consumer devices checked, or roughly one in 900
• about 0.7 per 1,000 on company-managed devices, a gap iVerify puts down to enforced updates and on-device security tools, according to The Record
• 75 percent of detections were criminal rather than state-sponsored, mostly using two exploit kits called Coruna and DarkSword. The rest involved mercenary spyware such as Pegasus.
• in every company case iVerify confirmed involving criminals, the person affected was an employee below managing director level, not a top executive

iVerify co-founder Rocky Cole told The Record that hundreds of thousands of consumer devices were scanned, but wouldn’t give an exact figure.

How the attacks reach people

The report describes a few ways phones are being infected now:

• Leaked government-grade exploits. iVerify says DarkSword and Coruna were exposed in March and DarkSword was then leaked on GitHub, putting full iPhone takeover tools in criminal hands. Criminal groups have since made their own variants.
• “Half-click” ads. iVerify says targeted display ads can start an exploit the moment the ad loads, and that it recorded one served on Instagram while the user was just scrolling.
• An App Store app. iVerify says an app it calls FomoPeek, distributed through Apple’s App Store, carried hidden tools that could escape the iPhone’s app sandbox and steal from other apps.
• Android remote-access trojans for rent. On Android, iVerify says cheap kits take over phones by abusing Accessibility Services, with no exploit needed, and that Google Play Protect flagged fewer than half of the devices where iVerify found a malicious app.

iVerify also says attackers clean up quickly, and that as far as it knows no device it confirmed as infected with DarkSword or Coruna received an Apple threat notification.

What to keep in mind

• The numbers describe iVerify’s users, not all iPhones. iVerify says its prevalence figures cover the population it monitors and are reported at the conservative end of its estimate. People who run a spyware check are more likely than average to suspect a problem.
• iVerify sells mobile security tools, and the report is written for security teams. Its recommendation to run security software on phones is also its business.
• The core trend is backed by others. The Record notes that Google’s Threat Intelligence Group first found Coruna, and that Coruna has been tied to a former defence-contractor executive who was sentenced this year for selling stolen exploits.

What you can do

1. Update your phone promptly. iVerify’s first advice to organizations is to require iOS and Android updates, and leaked kits like DarkSword have been used against phones that missed fixes. Turn on automatic updates.
2. Restart your phone now and then. Many iPhone exploits don’t survive a reboot, though a restart won’t undo stolen passwords.
3. Consider Lockdown Mode on iPhone if you think you’re at higher risk, for example if you hold a lot of cryptocurrency.
4. On Android, be careful with Accessibility permissions and don’t install apps from outside Google Play unless you trust the source.
5. Keep crypto wallet recovery phrases off your phone’s notes, photos and screenshots, since stealing crypto is a main goal of these attacks.

How Frame helps

Spyware steals from phones directly, so there isn’t a company breach to add. Frame can look up your verified emails in Have I Been Pwned’s breach database for other breaches. Frame doesn’t scan phones for spyware.

Related coverage

• Poisoned websites delivered data-stealing exploits to outdated iPhones and Android phones: a state-linked campaign that reused DarkSword code against phones that hadn’t been updated.
• How infostealers steal your sessions, and why a new password isn’t enough: why stolen logins outlast a password change, and what to do.

Sources

• iVerify, 2026 Advanced Mobile Threat Report, November 10, 2026
• The Record, Cybercriminals are increasingly infecting regular people with spyware, November 10, 2026