How iOS exploit kits and Android malware went from targeted to wide-net. Our 2026 report shows what changed and what security teams should do now.
How iOS exploit kits and Android malware went from targeted to wide-net. Our 2026 report shows what changed and what security teams should do now.
iOS infections per 1,000 consumer devices
iOS infections per 1,000 consumer devices
of detections were criminal, not state-
of detections were criminal, not state-
of enterprise detections from criminal actors were rank- and-file employees
of enterprise detections from criminal actors were rank- and-file employees
Prevalence figures describe the population iVerify monitors, not all iPhones, and are reported at the conservative lower end of our estimate
The economics of iPhone exploitation just broke
For more than a decade, a working iOS exploit chain took rare skills, months of work, and millions of dollars to build. It was used sparingly against a short list of journalists, dissidents, and officials, and most enterprises left phones out of their detection and response programs.
In 2026, that changed. The exposure of DarkSword and Coruna in March, and the leak of DarkSword on GitHub, put government-grade iOS exploits in criminal hands. Attackers delivered them through online ads, reached ordinary employees, and erased their traces before defenders could respond. Android faced the same shift, with cheap, ready-made kits that let criminals take over phones remotely.
Who the report is for: CISOs, SOC teams, threat hunters, and security architects responsible for the phones that touch corporate data, including BYOD fleets.
For more than a decade, a working iOS exploit chain took rare skills, months of work and millions of dollars to build. It was used sparingly against a short list of journalists, dissidents and officials, and most enterprises left phones out of their detection and response programs.
In 2026 that changed. The exposure of DarkSword and Coruna in March, and the leak of DarkSword on GitHub, put government-grade iOS exploits in criminal hands. Attackers delivered them through online ads, reached ordinary employees and erased their traces before defenders could respond. Android faced the same shift, with cheap, ready-made kits that let criminals take over phones remotely.
Who it's for: CISOs, SOC teams, threat hunters and security architects responsible for the phones that touch corporate data, including BYOD fleets.
State-grade tools, criminal scale
State-grade tools, criminal scale
Prevalence: ~1 in 900
Prevalence: ~1 in 900
Who is being targeted
Who is being targeted
Delivery: half-click attacks through ads & forgotten web code
Delivery: half-click attacks through ads & forgotten web code
The App Store: an exploit toolkit inside an approved app
The App Store: an exploit toolkit inside an approved app
Blast radius: each compromise exposes more
Blast radius: each compromise exposes more
Android: the year of the RAT
Android: the year of the RAT
Detection: less evidence means defenders must be on the device
Detection: less evidence means defenders must be on the device
Security assumptions that no longer hold
Security assumptions that no longer hold
The exposure of DarkSword and Coruna put government-grade iOS exploits in criminal hands. Criminal groups have since forked the code into new variants, including the P7 variant iVerify uncovered on a financial institution employee's phone.
Targeted display ads can launch half-click attacks, where the exploit starts the moment an ad renders. iVerify recorded one served on Instagram while the user was simply scrolling.
75% of this year's detections were criminals stealing credentials and cryptocurrency. In every enterprise case we confirmed, the person affected was an employee below managing director level.
FomoPeek, distributed through Apple's App Store, carried a hidden toolkit that could escape the iOS sandbox and steal from other apps. "Only install from the App Store" is no longer a sufficient policy.
Remote access trojans such as HyperRat, Cellik, and Octagon take over phones by abusing Accessibility Services, with no exploit needed. Google Play Protect flagged fewer than half of the Android devices where iVerify found a malicious app.
Attackers clean up aggressively and traces age off devices fast. To our knowledge, no device we confirmed as infected with DarkSword or Coruna received an Apple threat notification.
What security teams should do now
Treat employee phones as a front-line target, on par with laptops and servers.
Plan for mass campaigns, not only targeted ones Prepare for criminal campaigns against ordinary employees, not just state- attacks on executives or other high-risk staff.
Extend mobile security beyond a short list of leaders Ordinary staff are getting caught on iPhone and Android alike, so protection cannot stop at a short list of travelers or leaders.
Close the patching and sideloading gaps Require iOS and Android updates and security patches, and restrict sideloading on Android.
Get on the device Rely on EDR running on the phone, not on post-incident forensics or Apple threat notifications alone.
Make device sourcing a security decision Buy phones from trusted channels. Some budget Android devices arrive with malware preinstalled.
Half-Click Attacks: How Online Ads Now Deliver iPhone Exploits
An Exploit Inside an App Store App: What FomoPeek Means for "App Store Only" Policies
Android RATs for Rent: Five Remote Access Trojans and the $150-a-Month Phone Takeover
Mobile exploitation has gone mass-market. Get the full picture.
Frequently asked questions
What is the iVerify Advanced Mobile Threat Report?
How common are iOS spyware infections?
Who is being targeted by mobile attacks in 2026?
How is iVerify different from traditional Mobile Threat Defense (MTD)?
How are Android devices being compromised?
Will Apple threat notifications or forensics catch these attacks?
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
