iVerify Report Finds Spyware Reaching Beyond Traditional High-Value Targets
Summary
iVerify says spyware is reaching ordinary people, with three-quarters of 2026 detections linked to criminals stealing credentials and cryptocurrency. Its report also found a 1.07-per-1,000 infection rate among iOS consumer scans.
Key points
- iVerify described Apple Threat Notification cases involving the children of a bus driver and a stay-at-home mother in Ottawa, and a limousine driver in Australia.
- The report said three in four detections involved criminal adversaries stealing credentials and cryptocurrency, rather than state-sponsored actors.
- iVerify said the spyware infection rate remained relatively steady in 2026 at 1.07 infections per 1,000 iOS consumer scans.
- iVerify saw no devices infected by the DarkSword or Coruna iOS exploit kits among users who received Apple Threat Notifications; the report suggested Apple may be focused on state threats and well-known commercial spyware.
Article Details
- Event Type
- Report on a trend toward more indiscriminate spyware attacks affecting everyday people, alongside findings on iOS spyware infections and criminal activity.
- Impact
- iVerify reported that spyware detections increasingly affected people without public profiles or sensitive jobs, including the children of an Ottawa bus driver and a stay-at-home mom, and a limousine driver in Australia. The report said three in four detections that year involved criminal adversaries stealing credentials and cryptocurrency, and that stolen credentials were sold on the black market. The reported infection rate was 1.07 infections per 1,000 iOS consumer scans in 2026. iVerify also said it saw no devices infected by the DarkSword or Coruna iOS exploit kits among users who received Apple threat notifications.
People
Malware
Vendors
AppleAnd iVerify published a report Tuesday analyzing customer infections and threat notifications from Apple that contributes to the trend.iVerifyAnd iVerify published a report Tuesday analyzing customer infections and threat notifications from Apple that contributes to the trend.NSO Groupgiant might be overly focused on nation-state threats and well-known commercial mercenary spyware like NSO Group’s Pegasus.
Products
Apple Threat Notifications“In Ottawa, Apple Threat Notifications reached the children of a city bus driver and a stay-at-home mom,” it continued.iOSiVerify didn’t see any devices that were infected by the DarkSword or Coruna iOS exploit kits where users received Apple threat notifications, suggesting that the tech giant might be overly focused on nation-statePegasusbe overly focused on nation-state threats and well-known commercial mercenary spyware like NSO Group’s Pegasus.
Tools
CorunaiVerify didn’t see any devices that were infected by the DarkSword or Coruna iOS exploit kits where users received Apple threat notifications, suggesting that the tech giant might be overly focused on nation-stateDarkSwordiVerify didn’t see any devices that were infected by the DarkSword or Coruna iOS exploit kits where users received Apple threat notifications, suggesting that the tech giant might be overly focused on nation-state