Criminals are using government-grade spyware to infect iPhones

Sophisticated iPhone spyware once reserved for government surveillance is now being used by cybercriminals against ordinary users, with a new security report finding that criminal attacks account for most of its detections.

The findings come from mobile security firm iVerify's Advanced Mobile Threat Report 2026 , published November 10. Researchers found 1.07 spyware infections per 1,000 consumer iOS scans, or roughly one in 900, while the rate dropped to 0.7 per 1,000 when enterprise devices were included.

The figures reflect iVerify's users, not the global iPhone population. Its consumer base has more than tripled since early 2025, although the report doesn't disclose total scans or infections.

The bigger shift is who's being targeted. Every enterprise infection linked to a criminal campaign involved a rank-and-file employee, not a high-profile executive.

Leaked iPhone exploits are giving criminals new opportunities

Much of the shift comes from two iOS exploit kits known as Coruna and DarkSword , which security researchers publicly disclosed in March 2026.

Google's Threat Intelligence Group identified Coruna as a collection of 23 exploits organized into five attack chains targeting iOS 13 through iOS 17.2.1. During 2025, researchers observed its use by a surveillance vendor's customer, followed by a suspected Russian espionage group targeting Ukrainian websites.

The same toolkit later appeared in widespread attacks operated by a financially motivated group in China. Google couldn't establish exactly how Coruna passed between those operators, but its research demonstrated how sophisticated exploitation techniques could spread beyond their original users.

DarkSword followed a similar trajectory. Researchers from Google, Lookout, and iVerify disclosed the exploit chain on March 18 after identifying its use by surveillance vendors and suspected state- actors.

The toolkit targeted iPhones running iOS 18.4 through iOS 18.7, exploiting six vulnerabilities to compromise devices and extract sensitive information. Apple addressed those vulnerabilities through subsequent security updates , with Google confirming that all six had been patched by iOS 26.3.

Both toolkits originally targeted specific older iOS releases, making software updates an important defense. The attacks documented in the report don't establish that the same exploit chains can compromise fully updated iPhones.

The subsequent release of DarkSword code gave criminals a starting point for developing their own variants without having to discover every vulnerability themselves.

iVerify has since identified modified versions capable of collecting additional passwords, messages, photographs, and cryptocurrency wallet information.

Malicious ads can infect vulnerable iPhones without a click

A second attack occurred later after the same person followed a link. Researchers identified a different DarkSword variant associated with another threat actor, although both attacks appeared intended to steal cryptocurrency.

Advertising networks let criminals narrow their targets using details such as device type, iOS version, location, and interests. Attackers can use that information to deliver exploits specifically to iPhones running vulnerable software.

The approach combines the reach of online advertising with the ability to target specific vulnerabilities. Someone browsing a legitimate website or scrolling through social media could encounter an attack without downloading anything or visiting a suspicious page.

Criminals have also hijacked legitimate websites through abandoned tracking scripts. In October, researchers uncovered a campaign that used an expired analytics domain to redirect visitors from thousands of online stores to malicious servers distributing DarkSword and Coruna.

The victims didn't need to visit a fraudulent storefront because the compromised code was already embedded in otherwise legitimate websites.

App Store protections aren't completely immune

The report also highlights FomoPeek, a cryptocurrency monitoring app that carried a hidden exploitation toolkit in versions distributed through Apple's App Store in September. Security researchers at SlowMist and OKX found malicious components in versions 1.1 and 1.2.

The toolkit could exploit iOS vulnerabilities, escape the app sandbox, and access data belonging to other apps.

The affected versions appeared on September 9 and September 12, before an update removed the malicious components on September 17. SlowMist's investigation traced approximately $580,000 in stolen USDT to a cryptocurrency address associated with the operation.

Researchers confirmed the toolkit's ability to collect application data in a controlled environment, including information from Apple Notes. Their findings don't establish that every supported exploit succeeded or that every targeted cryptocurrency wallet was compromised.

FomoPeek is one documented case rather than evidence of widespread App Store exploitation. Still, it demonstrates that Apple's review process cannot guarantee every approved app is free from malicious code.

Apple threat notifications don't cover every attack

Detecting a successful compromise presents another problem because newer spyware variants can erase evidence before security researchers have an opportunity to investigate. DarkSword can collect stored credentials and other information without maintaining a persistent infection.

Newer variants also remove additional logs and working files, making it harder to reconstruct an attack after the malware has finished running.

A compromised work iPhone could expose credentials for corporate email, messaging platforms, and other services. Criminals could then use those credentials to access accounts beyond the infected device.

iVerify reports that none of the devices it confirmed as infected with DarkSword or Coruna received an Apple threat notification .

Apple's warning system has a narrower purpose, however. The company says its notifications are designed for people believed to have been individually targeted by mercenary spyware, typically because of their identity or activities.

The absence of a warning therefore doesn't establish that Apple's system failed at its intended purpose, nor should users interpret silence as proof that their device hasn't been compromised.

The report warns that AI is accelerating exploit development, although iVerify's testing found limits to its effectiveness. Researchers examined suspected AI-assisted attempts to adapt DarkSword for newer iOS versions, but none successfully exploited the devices tested.

Keeping iOS updated remains one of the best defenses against these attacks, since security patches close vulnerabilities that criminals continue to exploit. Installing apps from trusted sources also reduces exposure to other forms of malware.

iVerify recommends extending mobile security monitoring beyond executives, particularly when employees use personal phones for work. The company sells mobile detection products, giving it a commercial interest in recommending continuous monitoring.

The findings don't mean every iPhone can be silently compromised. They show how criminals can reuse sophisticated exploits against vulnerable devices, putting ordinary users at risk alongside traditional surveillance targets.

How to protect your iPhone from spyware

Keeping your iPhone updated is the most effective defense against the exploit chains documented by iVerify. Open Settings, select General, then Software Update to check for available patches.

You can also enable automatic installation under Automatic Updates so your iPhone receives future fixes without requiring you to check manually.

Only download apps from trusted sources, and check the developer before installing unfamiliar software. Apple's App Store provides security protections, but the FomoPeek incident shows that approved apps aren't automatically safe.

Using strong, unique passwords and two-factor authentication also helps protect accounts, although neither can guarantee protection if the device itself is compromised.

People concerned sophisticated, targeted spyware can consider Lockdown Mode , which restricts certain apps, websites, and features to reduce potential attack paths. Apple designed the feature for people facing unusually serious surveillance threats, so most iPhone owners won't need it.