Image credit: ChatGPT illustration by Suzanne Kantra/Techlicious
Advanced iPhone spyware was once primarily a concern for journalists, activists, government officials, and others specifically selected for surveillance. Now criminals are using similar tools in broad campaigns designed to steal passwords, cryptocurrency, and other valuable data from ordinary iPhone owners.
In its newly released 2026 Advanced Mobile Threat Report, security firm iVerify says criminal operations accounted for 75% of the advanced mobile attacks it detected this year, overtaking state-sponsored and mercenary-spyware campaigns. The company found roughly one infection for every 900 devices it monitored.
That figure requires an important qualification: It does not mean one in every 900 iPhones is infected. The rate comes from iVerify’s own monitored population, which is not a representative sample of all iPhone owners. People who run security scans may also be more likely than average to suspect a problem.
Even with those limitations, the report provides compelling evidence of a significant change in who faces these attacks. And the company says it is now confirming attacks every week.
Leaked spyware tools gave criminals government-grade capabilities
The change is being driven largely by two iPhone hacker toolkits called DarkSword and Coruna. These toolkits use chains of software vulnerabilities to break through several layers of iOS security, giving attackers capabilities previously associated with expensive commercial spyware sold to governments.
For years, the high cost and scarcity of advanced hacking tools encouraged governments and spyware vendors to reserve them for carefully chosen targets. But the underlying exploits are no longer closely held secrets. DarkSword was publicly leaked, while Coruna incorporates technology stolen from a defense contractor.
Criminal groups have since adapted the code, created new variants, and built infrastructure capable of delivering the spyware to large numbers of potential victims. Once inside an unpatched iPhone, the spyware may be able to extract Keychain passwords, messages, contacts, photos, location information, and cryptocurrency-wallet data. Some versions can also activate the device’s microphone or camera.
Unlike ordinary malicious apps, DarkSword and Coruna don’t necessarily need to trick someone into installing software. They exploit vulnerabilities in Safari, WebKit, and iOS itself, allowing an attack to start when a vulnerable iPhone loads malicious web content.
An infected ad may be enough to trigger an attack
Some of these infections are delivered through malicious advertising and compromised websites. In one case documented by iVerify, a DarkSword variant began running when an Instagram ad appeared while a person was scrolling through the app. The victim did not tap or interact with the ad.
The researchers do not claim that Instagram itself was compromised. Online advertising passes content through a complicated chain of buyers, sellers, exchanges, and tracking services, creating opportunities for malicious material to slip through.
Ad systems also let buyers target people according to their device, operating-system version, location, and interests. A criminal with an exploit that works against a particular version of iOS can direct malicious ads specifically at vulnerable iPhones – and potentially at users interested in cryptocurrency.
Other attacks exploit forgotten code embedded in legitimate shopping sites. iVerify and web-security service Report URI found criminals registering expired domains once used by analytics services. Thousands of websites were still attempting to load scripts from those domains, giving their new owners a way to place malicious code in otherwise legitimate sites.
Apple’s threat notifications may not catch these campaigns
Apple sends threat notifications to people it believes have been individually targeted by sophisticated mercenary spyware. These warnings appear on the iPhone, arrive by email, and are displayed after the user signs in at account.apple.com.
However, iVerify says none of the devices it confirmed were infected with DarkSword or Coruna received one of these notifications. Apple’s system is intended primarily to identify highly targeted mercenary-spyware attacks, not necessarily broad criminal campaigns using leaked tools. Apple has not publicly responded to iVerify’s finding.
Users should also be wary of fake Apple security alerts. According to Apple’s threat-notification guidance, a genuine warning will never ask you to install software, open an attachment, or provide your password or verification code.
Updating your iPhone is the most important protection
The attacks documented by iVerify primarily succeed against iPhones running older versions of iOS. DarkSword has been observed targeting versions from iOS 18.4 through iOS 18.7, and Apple says fully updated devices are protected against the previously reported web attacks.
Go to Settings > General > Software Update and install the newest release available for your iPhone. As of November 11, the latest release for supported devices is iOS 27.2.1, which Apple issued on November 9. Owners of older models should install the latest security update their device supports.
The larger lesson is that sophisticated iPhone attacks are no longer limited to people who expect to be placed under surveillance. Leaked exploit frameworks have made some of the same capabilities available to criminals interested in the password or cryptocurrency wallet of anyone whose unpatched iPhone happens to load the wrong ad. Keeping iOS current has consequently become even more important – not because every iPhone is under attack, but because ordinary users can no longer assume they won't be a target.
