iVerify’s 2026 Advanced Mobile Threat Report says criminals now account for three in four iPhone spyware detections, using leaked exploit kits served through adverts and ordinary websites. The victims it confirmed inside companies were everyday staff rather than executives, and, iVerify argues, most security operations centres are not watching phones at all.
What happened
On 10 November 2026, mobile detection and response vendor iVerify, which operates from Belfast and New York, published its Advanced Mobile Threat Report for 2026. Its central claim is that iPhone exploitation is no longer scarce: chains once reserved for journalists, dissidents and officials are now in criminal hands and used indiscriminately.
By iVerify’s conservative estimate, 1.07 in every 1,000 consumer iOS devices it monitors showed signs of infection as of October 2026, or roughly one in 900. According to The Record, the firm saw a lower rate of 0.7 per 1,000 scans on enterprise devices, which it credits to enforced patching, on-device detection and network controls. About 75% of detections were criminal operations chasing credentials and cryptocurrency, with the remainder attributed to mercenary spyware such as Pegasus.
The baseline comparison needs care. iVerify’s press release puts its December 2024 infection rate at 1.5 per 1,000, while The Record reports that the earlier study detected Pegasus on 2.5 of every 1,000 phones checked. Either way, iVerify says the rate remains broadly in line with that earlier finding, even though far more ordinary consumers now use the free checks, which co-founder Rocky Cole expected to dilute it.
The detail that matters most for defenders is who was hit. In every enterprise case iVerify confirmed involving a criminal actor, the phone belonged to someone below managing director level, compromised at the office or at home. Cole described the campaigns as “dragnet operations” in the company’s announcement.
The technical picture
Two exploit kits drive most of the criminal activity. DarkSword and Coruna were exposed in March 2026, and DarkSword then leaked on GitHub. Help Net Security reports that a newer version appeared there within a week, and iVerify says criminal groups have since forked the code, including a variant it calls P7, found on the phone of a financial institution employee. Coruna, which The Record notes was first identified by Google Threat Intelligence Group in February 2025, has been used to steal cryptocurrency from more than 42,000 iOS devices through fake Chinese-language finance sites.
Delivery is where this departs from the classic spyware model. iVerify describes “half-click” attacks, in which the exploit starts as soon as a display advert renders, with no tap required. It recorded one such advert on Instagram while the user was just scrolling. Help Net Security reports that one DarkSword chain checked for Safari on iOS 18.4.0 to 18.7.2 before firing, delivered via an expired analytics domain documented by Report URI’s Scott Helme. These kits hit phones running vulnerable, unpatched iOS versions.
The App Store is no longer a safe harbour either. iVerify says an approved app, FomoPeek, carried a hidden toolkit able to reach data belonging to other apps, which undermines the common policy of allowing anything from the official store. On Android, rented trojans including HyperRat, Cellik and Octagon hijack handsets by abusing Accessibility Services, no exploit needed. Where iVerify found a malicious Android app, Google Play Protect had raised a flag on under half of those devices.
What the attackers take is what makes this a corporate problem. Help Net Security reports that DarkSword can extract Keychain passwords and other sign-in material, and one Coruna payload hunted for wallet recovery phrases. Evidence is also short-lived: restarting or updating the handset can wipe the active implant. iVerify adds that, to its knowledge, none of the DarkSword or Coruna victims it confirmed was warned by Apple’s threat notification system.
Why it matters for UK organisations
The report gives no country breakdown, so it cannot tell us how many UK handsets are affected. But the conditions it describes are standard in British workplaces. Staff read work email, approve MFA prompts, join Teams calls and open SaaS apps on phones, and a large share of those phones are personally owned. A stolen session token or saved password from an employee’s iPhone can open the same doors as a compromised laptop, without touching any device the SOC actually monitors.
iVerify extrapolates that a Fortune 500-sized organisation with 61,000 staff, each with one phone, would see around 65 infections a year. Treat that as a vendor model built on its own monitored population, not a measured UK figure. Even a fraction of that in a large NHS trust or bank would matter, and few would have telemetry to see it.
There is also a governance angle. Cyber Essentials already brings mobile devices into scope when they access organisational data, including personally owned ones, and requires high and critical updates within 14 days. But patch status and MDM enrolment are not detection.
Expert view
In my experience, mobile is the largest blind spot in most UK detection programmes. When we scope assessments, phones usually appear only as an MDM console screenshot. Nobody can say what ran on a handset last Tuesday, and playbooks rarely include a step for seizing or imaging a phone before it reboots.
Read the report with its source in mind. iVerify sells on-device mobile EDR, and every headline figure comes from the population it monitors, which it acknowledges is not all iPhones. Those caveats do not undo the core finding that working iOS exploit chains have leaked and are being commoditised. As Brad Arkin of LeverSec said in comments carried by Help Net Security, “DarkSword and Coruna give criminals another way in.”
The most useful lesson is about threat models. Many organisations protect only executives’ and frequent travellers’ phones. Campaigns that buy advertising impressions do not check job titles.
What to do now
- Enforce current iOS and Android versions. Use MDM or conditional access to block corporate apps on devices below a minimum OS level. This maps to Cyber Essentials security update management.
- Bring phones into the SOC. Feed mobile threat signals, MDM posture and identity events into your SIEM, and alert on sign-ins from unmanaged or non-compliant handsets.
- Shrink what a stolen phone credential can do. Prefer phishing-resistant MFA, shorten token lifetimes for mobile sessions, and be ready to revoke sessions quickly when a handset is suspected.
- Widen protection beyond executives. Extend mobile security to everyone whose phone touches company data, including BYOD users, not just leaders and travellers.
- Tighten app controls. Restrict Android sideloading, review Accessibility Services permissions, and stop treating “App Store only” as sufficient on its own. This aligns with Cyber Essentials secure configuration and malware protection.
- Update the incident response playbook. Add steps for preserving mobile evidence before rebooting or updating a suspect device, and do not rely on Apple threat notifications as your detection.
- Source devices carefully. iVerify warns that some budget Android handsets ship with malware preinstalled, so buy through trusted channels.
Bottom line
iVerify’s data says iPhone exploitation has moved from scarce, targeted espionage to commodity crime aimed at ordinary employees. Whatever the precise infection rate, UK organisations that let phones reach corporate data should patch them, monitor them and include them in incident response.
Sources
- The Record: Cybercriminals are increasingly infecting regular people with spyware
- Help Net Security: An Instagram ad was all it took: Leaked exploit kits are hitting employees’ iPhones
- iVerify: Advanced Mobile Threat Report 2026
- iVerify via EIN Presswire: iVerify’s 2026 Advanced Mobile Threat Report Finds Spyware Has Gone Mainstream
