Sophisticated spyware once reserved for nation-state surveillance is now infecting everyday iPhone users, according to a security report released November 10. Data from the 2026 Advanced Mobile Threat Report by mobile security firm iVerify shows criminal activity accounts for the majority of these infiltrations. Among consumer iOS scans, there are approximately 1.07 spyware detections per 1,000 devices—about one in 900. The rate drops to roughly 0.7 per 1,000 when enterprise devices are included. The shift reflects not only increased volume but also a broader target base, affecting ordinary individuals more than high-profile figures.
Coruna & DarkSword: From State Tools to Criminal Exploits
Two major exploit kits—Coruna and DarkSword—are central to this trend. Initially used by surveillance vendors and state-aligned actors, these toolkits have been expanded by criminal groups. Coruna consists of 23 exploits covering iOS 13 through iOS 17.2.1. DarkSword targeted iPhones running iOS 18.4 through 18.7 using six vulnerabilities, all of which have since been addressed in iOS 26.3. These frameworks are now being retooled by attackers for wider distribution, enabling unauthorized access to photos, messages, passwords, and crypto wallets.
Attack Routes: No Click Required
Some of the most alarming attacks bypass any kind of tap. One documented case involves a user who suffered back-to-back DarkSword attacks—first triggered by a malicious advertisement during Instagram browsing, and later via a malicious link. In the first, loading that ad alone initiated the exploit. Such “half-click” attacks exploit ad networks’ targeting tools—filtering by iOS version, device type, location, interests—to deliver malware to precisely vulnerable devices. The same report describes the abuse of tracking scripts on legitimate websites: expired analytics domains have been repurposed to serve DarkSword or Coruna payloads without any suspicious storefront or landing page.
Even Apple’s curated App Store isn’t fully protected. An app called FomoPeek, aimed at tracking cryptocurrency markets, included a hidden exploit toolkit in certain versions. Between early and mid-September, the app versions contained code that broke out of the app sandbox and scooped data from other apps. About $580,000 in USDT is linked to this operation before the malicious components were removed. That said, this seems to be an isolated incident rather than proof of widespread App Store compromise.
Invisible Threats & Warning Gaps
DarkSword and Coruna infections can erase key forensic traces, making detection after the fact difficult. Newer variants can harvest credentials, logins, messages, images—and do so without maintaining a persistent presence on the device. Even more concerning: in all confirmed infections from either toolkit, none triggered an Apple threat notification. These alerts are only designed for people believed to be individually targeted by sophisticated spyware, meaning broad or random attacks often fly under the radar.
For now, defense hinges on updated software. Touching on the iVerify findings, updated iPhones running patched OS versions remain safe from the documented exploit chains. Users are encouraged to enable automatic updates, restrict app downloads to trusted sources, and enable two-factor authentication. Individuals at higher risk, such as those in sensitive roles, may benefit from Lockdown Mode, which limits attack vectors by restricting apps, features, and websites.
This report marks a turning point: malware once strictly associated with espionage is increasingly accessible to common criminal groups—and ordinary users are now in their crosshairs. That suggests Apple’s protections need to evolve, too—not just for executives or influencers, but for everyone who owns an iPhone. If you’re maintaining older iOS versions or downloading lesser-known apps, your risk is growing. Keep your firmware current, avoid risky apps, and consider stricter privacy settings. What once felt like exotic threats are now everyday risks.
