Spyware Infections Surge Among Everyday Users
A new report from threat hunting firm iVerify reveals that cybercriminals are now infecting ordinary consumers with sophisticated iOS spyware at a rate exceeding enterprise targets. The company found 1.07 spyware infections per 1,000 consumer scans of its free online checks, compared to 0.7 infections per 1,000 enterprise scans. Rocky Cole, iVerify co-founder, said hundreds of thousands of consumer devices were scanned, while an average Fortune 500 company experiences roughly 65 infections annually on its devices.
Criminal Actors Replace Governments as Primary Threat
"The takeaway is that this is the year that iOS spyware went mainstream and became everyone's problem," Cole stated. "The number one threat actor using spyware targeting iPhones these days is not governments; it's just cyber criminals, and it's a problem that is indiscriminate." Unlike politically motivated surveillance, many detected infections were used for credential and cryptocurrency theft.
Exploit Kits Drive Indiscriminate Attacks
About 75% of detections involved criminal actors deploying the Coruna or DarkSword exploit kits. These frameworks enable attacks at scale through online ads and compromised websites, reaching ordinary employees and erasing traces before defenders can respond.
DarkSword: Zero-Click Watering Hole Attacks
DarkSword, an advanced full-chain JavaScript-based iOS exploit kit and spyware framework first made public in March, is deployed via "watering hole" attacks. Simply visiting a compromised website through a web browser can trigger infection without any user interaction.
Coruna: Stolen From Defense Contractor
Coruna is also delivered via web-based attacks exploiting WebKit and kernel vulnerabilities. The spyware framework was stolen from a defense contractor and used by cybercriminals to steal cryptocurrency from over 42,000 iOS devices through fake Chinese-language financial websites. Google Threat Intelligence Group discovered Coruna in February 2025, and it proliferated throughout the year. Former L3Harris Trenchant executive Peter Williams pleaded guilty to stealing exploits and selling them on the black market for cryptocurrency, receiving a seven-year prison sentence in February 2026.
Capabilities Match Nation-State Tools
Both DarkSword and Coruna offer the same level of phone takeover as advanced commercial spyware like Pegasus, exposing messages, photos, emails, and activating microphones and cameras. The critical difference: Pegasus and similar tools are sold exclusively to nation-state clients, while DarkSword and Coruna circulate broadly among criminal actors. Device owners infected with these frameworks did not receive Apple threat notifications.
"Mercenary Spyware Was Built as a Scalpel — Now It's a Net"
Nic Adams, co-founder and CEO of cyberkinetics company 0rcus, characterized the infection rate: "One in 900 is a dragnet number, not a targeting number. Mercenary spyware was built as a scalpel — now it's being used as a net." Android faces a similar shift, with inexpensive turnkey spyware kits enabling remote phone takeovers.
Threat Models Must Evolve Beyond VIP Protection
iVerify researchers expected infection rates to decline this year as consumer scan usage quadrupled. Two years ago, most people checking devices were elites suspecting targeted surveillance. A December 2024 iVerify report found Pegasus infections at 2.5 per 1,000 devices, when nation-state attacks were considered the predominant threat and Coruna and DarkSword were not yet in the marketplace.
"Businesses need to update their threat models to stop focusing on VIPs and just assume this is a problem that everyone in the organization has to tackle," Cole emphasized. Notably, many infected enterprise employees were rank-and-file workers rather than executives, underscoring the indiscriminate nature of current campaigns.
Source: The Record