iVerify’s 2026 Advanced Mobile Threat Report Finds Spyware Has Gone Mainstream

iVerify logo

Detections from criminal groups overtake nation-state actors as spyware proliferates

BELFAST, NORTHERN IRELAND & NEW YORK, NY, UNITED STATES, November 10, 2026 /EINPresswire.com/ -- iVerify, the pioneer in advanced mobile endpoint detection and response (EDR), today released the results of its inaugural advanced mobile threat report, indicating that advanced mobile attacks are now a mass threat, no longer a concern only for high-value targets such as CEOs, journalists and civil society. Findings show that most spyware detections (75%) stem from criminal campaigns deployed in mass attacks rather than highly targeted operations by nation-state actors.

The mass proliferation of advanced spyware centers on two leaked iOS exploit kits, Coruna and DarkSword, iVerify’s threat intelligence team helped uncover in March of this year. Criminal groups, some suspected to operate out of China, are deploying both kits at mass scale. Their delivery methods include online advertising infrastructure, watering hole attacks on legitimate and attacker-built websites, and a range of phishing lures. These campaigns impact everyday iPhone users running vulnerable versions of iOS and account for the vast majority of infections detected within enterprise environments.

“One of the most common misconceptions among security and business leaders is that mercenary spyware and other advanced mobile hacking techniques are rare, only target senior-level staff, and only when they are traveling to China. Our data says otherwise,” said Rocky Cole, co-founder and COO of iVerify. “We are confirming attacks every week, and every enterprise detection from a criminal actor has been on the phone of a rank-and-file employee, below managing-director level, and occurred while they were at the office or home. They’re dragnet operations, and any employee with a vulnerable iPhone can get caught in one.”

Coruna and DarkSword activity, combined with ongoing nation-state operations using spyware such as Pegasus and Predator, keep infection rates in line with what iVerify first reported in December 2024. At that time, iVerify found 1.5 infections per 1,000 devices. As of October 2026, the rate stands at 1.07 per 1,000 devices, based on a conservative analysis. For a Fortune 500 company with an average of 61,000 employees, each with one mobile device, that translates to an estimated 65 infections per year.

“Credential theft is big business for cyber criminals. Groups like Scattered Spider and ShinyHunters have used social engineering and stolen identities to break into corporate networks and extort millions of dollars,” said Brad Arkin, principal at LeverSec and former chief trust officer at Salesforce. “DarkSword and Coruna give criminals another way in. Between them, they can pull stored passwords, messages, notes, and photos from an iPhone and steal cryptocurrency. If an employee’s phone is infected, that person’s legitimate credentials can become the starting point for a much larger breach, and the login would look like normal activity.”

Businesses that rely on OEM-provided security for iOS devices may be surprised to learn that iPhones with confirmed DarkSword and Coruna infections are not receiving Apple Threat Notifications. That means an employee may never know their device was infected, and IT administrators may not know where a user’s credentials were stolen. The phones iVerify investigated that did receive Apple Threat Notifications showed limited evidence of other mercenary spyware, but even that trail is disappearing.
Mobile malware developers across the spectrum are getting much better at cleaning up malicious behavior, leaving fewer traces behind. This makes time a critical factor for investigations. Since Apple sends Threat Notifications in batches, not in real time, most of the evidence of when and how the device was infected is already gone by the time it’s received. iVerify forensic experts conclude that high-confidence spyware detection now requires real-time, on-device visibility.

“AI is collapsing the time from vulnerability discovery to working exploit, while making mobile malware stealthier and better at covering its tracks,” said Gary Hayslip, CISO in Residence at Zenity. “AI has lowered the barrier to entry for cybercrime, putting capabilities once reserved for nation-states in the hands of ordinary cybercriminals. That should be a wakeup call for security teams who have outsourced mobile security to OEMs. Without on-device visibility, a ransomware deployment could be the first sign a mobile device was compromised, and there’d be no reliable way to confirm it.”

As frontier AI continues to chew through technical debt, finding new vulnerabilities and getting better at turning them into exploits, real-time, on-device visibility, already standard on laptops and servers, is a defender’s best tool. Apple’s iOS 27 and iOS 27.2 updates alone fixed more than 300 vulnerabilities, and every device that hasn’t installed those patches remains exposed. Real-time visibility provides the only meaningful assurance against compromise where patching alone cannot.

To read the full report visit: https://www.iverify.com/advanced-mobile-threat-report-2026

About iVerify

iVerify is a pioneer in mobile endpoint detection and response (EDR) solutions, providing advanced protection against the real threats mobile devices face. The company's comprehensive security platform safeguards organizations from fileless malware, smishing, malicious applications, ransomware operations, and breaches resulting from credential theft. iVerify's solutions span from consumer to enterprise and government sectors, offering both privacy-focused BYOD protection and enterprise-grade security capabilities to ensure every device in the workplace is secure.

For more information, please visit: www.iverify.com.

Monika Hathaway
iVerify

Legal Disclaimer:

EIN Presswire provides this news content "as is" without warranty of any kind. We do not accept any responsibility or liability for the accuracy, content, images, videos, licenses, completeness, legality, or reliability of the information contained in this article. If you have any complaints or copyright issues related to this article, kindly contact the author above.