Spyware Threat Landscape Shifts Toward Indiscriminate Targeting
Mounting evidence indicates that spyware attacks are growing less targeted and more indiscriminate, increasingly affecting ordinary citizens rather than the traditional high-value targets such as government officials, journalists, or corporate executives. A report published Tuesday by iVerify, analyzing customer infections and Apple Threat Notifications, contributes significant data to this emerging trend.
Apple Threat Notifications Reach Unexpected Recipients
Conventional guidance on spyware risk has long focused on individuals with public profiles, sensitive jobs, or roles that place them on a government's radar. However, iVerify's findings challenge this assumption. The company observed Apple Threat Notification cases in 2026 that do not fit the established pattern.
In Ottawa, notifications reached the children of a city bus driver and a stay-at-home mother. In Australia, a limousine driver received an alert. None of these individuals had a public profile, a sensitive job, or an obvious connection to anyone considered worth spying on. These cases matter because they demonstrate the threat reaching people who had no reason to expect it.
For an enterprise, the employees most likely to be hit look much more like the limousine driver than like the CEO.
AdFection Campaign Exemplifies Mass Infection Vectors
The AdFection spyware attacks, which could infect anyone visiting a website carrying advertising, represent the most recent revelation of this indiscriminate approach. Such mass-infection vectors bypass the need for individualized targeting, casting a wide net that captures anyone browsing compromised sites.
Criminal Groups Drive Majority of Detections
Rocky Cole, co-founder of iVerify, told CyberScoop that the shift reflects a change in who is deploying spyware. The vast majority of iVerify's detections were mass attacks carried out by criminal groups pursuing purely financial motives.
For the purposes of stealing credentials and selling them on the black market, an executive credential is not necessarily more valuable than that of a system administrator or even an average employee. Part of the reason everyday employees are hit more frequently is that when attacks are less targeted, they are more likely to compromise individuals who are not as diligently focused on routine cyber hygiene, compared to CEOs who likely upgrade their defenses regularly.
Key Findings From the 2026 iVerify Report
Infection Rates and Adversary Breakdown
The rate of spyware infections held relatively steady in 2026, at 1.07 infections per 1,000 iOS consumer scans. Notably, three in four of this year's detections were attributed to criminal adversaries stealing credentials and cryptocurrency, not state-sponsored actors.
Potential Gaps in Apple's Threat Notification Focus
iVerify did not observe any devices infected by the DarkSword or Coruna iOS exploit kits where users received Apple Threat Notifications. This suggests that Apple might be overly focused on nation-state threats and well-known commercial mercenary spyware such as NSO Group's Pegasus, potentially missing infections from other exploit kits.
Implications for Enterprise Security
The findings carry direct implications for organizational security postures. Since the employees most likely to be compromised resemble ordinary citizens rather than high-profile executives, enterprises must extend advanced protections and hygiene practices across the entire workforce, not just leadership teams. The commoditization of spyware by criminal groups means credential theft operates at scale, valuing volume and accessibility over target prestige.
Source: CyberScoop