Spyware once built for government surveillance is now being used by ordinary criminals against ordinary iPhone owners, according to a new security report. Mobile security firm iVerify published its 2026 Advanced Mobile Threat Report on 10 November, and its central finding is a shift in who the targets are: three-quarters of the spyware detections in its data came from mass criminal campaigns, rather than from highly targeted operations by nation states.

The figures describe iVerify's users rather than the whole iPhone population. The firm recorded 1.07 spyware infections for every 1,000 consumer iOS devices it scanned, or roughly one in 900. When enterprise devices were included, the rate fell to 0.7 per 1,000. Every enterprise infection linked to a criminal campaign involved a rank-and-file employee.

From surveillance tool to criminal weapon

Much of the change comes from two iOS exploit kits, Coruna and DarkSword, which researchers publicly disclosed in March 2026. Both began life in the world of surveillance vendors and suspected state-sponsored actors. Both have since leaked, and criminals have picked them up.

Google's Threat Intelligence Group identified Coruna as a collection of 23 exploits organised into five attack chains, aimed at iOS 13 through iOS 17.2.1. During 2025 researchers saw it used by a surveillance vendor's customer, a suspected Russian espionage group, and later a financially motivated group in China.

DarkSword followed a similar path. Researchers from Google, Lookout and iVerify disclosed the exploit chain on 18 March, after finding it in use by surveillance vendors and suspected state-sponsored actors. It targeted iPhones running iOS 18.4 through iOS 18.7, chaining together six vulnerabilities to take over a device and extract sensitive information. Apple has since patched all six, with Google confirming they were fixed by iOS 26.3. A newer version appeared on GitHub within a week, giving criminals working code to adapt.

An infection that needs no tap

The report's most unsettling case involved an ordinary person who was hit by DarkSword twice. The first attack began when a malicious advertisement loaded during an Instagram browsing session. The user did not click the advert, yet the exploit started running on the vulnerable phone. A second attack came later, after the same person followed a link. Researchers attributed the two incidents to separate actors and assessed that both were trying to steal cryptocurrency.

Security researchers call this a half-click attack, because malicious code can start executing when an advertisement loads, without the victim interacting with it. Advertising networks let criminals narrow their targets by device type, iOS version, location and interests, so exploits can be delivered precisely to phones running vulnerable software.

Criminals have also hijacked legitimate websites through abandoned tracking scripts. In October, researchers uncovered a campaign built around an expired analytics domain. Online stores that still referenced the domain in their website templates sent visitors to servers controlled by the new owner. The operation, known as DeadTag, used more than 660 re-registered domains across thousands of websites, which Report URI estimated received a combined 135 million visits a month.

What the kits can take

Once inside, DarkSword can extract passwords and other sign-in information from the iPhone's Keychain, along with messages, notes and photographs. Modified versions identified by iVerify can also collect additional passwords and cryptocurrency wallet information. One Coruna payload searched text and images on the phone for wallet recovery phrases, which can hand an attacker control of a cryptocurrency wallet.

An infected personal phone can also expose work accounts. If an employee uses the same phone for work email, messaging or remote access, stolen credentials or session tokens could give attackers a way into company services, with a login that looks like normal activity. As the report notes, an infected employee's legitimate credentials can become the starting point for a much larger breach.

An App Store warning too

The report also highlights FomoPeek, a cryptocurrency monitoring app that carried a hidden exploitation toolkit in versions distributed through Apple's App Store in September. Security researchers at SlowMist and OKX found the malicious code in versions 1.1 and 1.2, which appeared in September before an update removed it. The toolkit could exploit iOS vulnerabilities, escape the app sandbox and reach data belonging to other apps. SlowMist's investigation traced about $580,000 in stolen USDT, a dollar-linked cryptocurrency, to an address linked to the operation.

How to protect your iPhone

Keeping iOS updated is the most effective defence, because the patches close the flaws these kits exploit. Users should also enable automatic updates, download apps only from trusted sources, and use strong, unique passwords with two-factor authentication. The findings do not mean every iPhone can be silently compromised, but they show exploits once reserved for high-value targets are now being reused against vulnerable devices at scale.