Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoChighExploited in the wild

iVerify: criminal spyware kits infect ordinary iPhone users

3 sources · 3 articlesFirst reported Updated ()1
What's new

November 11: Help Net Security adds an Instagram-ad DarkSword chain against iOS 18.4.0–18.7.2, Keychain and wallet theft, a March 2026 disclosure, and Report URI domain-traffic figures.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

iVerify’s 2026 report finds 1.07 spyware infections per 1,000 consumer iOS scans, mostly via DarkSword and Coruna rather than mercenary tools.

iVerify’s 2026 Advanced Mobile Threat Report says criminal exploit kits are infecting ordinary iPhone users and employee devices more often than mercenary spyware. Consumer scans showed 1.07 infections per 1,000 devices, versus 0.7 in enterprise scans; about three in four detections involved Coruna or DarkSword, used for credentials and cryptocurrency, with the rest mercenary tools such as Pegasus. Help Net Security says one DarkSword chain began with an Instagram ad and targeted iOS 18.4.0 through 18.7.2 to steal Keychain data; a Coruna payload looked for wallet recovery phrases. Infected owners did not receive Apple threat notifications, iVerify said. Researchers did not state how many phones were infected.

Key facts
  • Consumer rate 1.07 per 1,000 scans; enterprise rate 0.7, The Record said.
  • About 75% of detections were Coruna or DarkSword, not mercenary spyware.
  • DarkSword targeted Safari on iOS 18.4.0 through 18.7.2, Help Net Security said.
  • Coruna linked to crypto theft from more than 42,000 iOS devices, The Record said.
  • DarkSword was disclosed in March 2026; a newer build appeared on GitHub within a week.
  • Report URI: sites on more than 660 re-registered domains drew 135 million visits a month.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 10, 2026iVerify report: 1.07 consumer spyware infections per 1,000 scans · The Record
  2. Nov 11, 2026Help Net details Instagram-ad DarkSword chain and iOS versions · Help Net Security

What each outlet adds

beyond the shared facts
  • CyberScoopNotifications reached relatives of an Ottawa bus driver and an Australian limo driver.
  • The RecordEnterprise rate 0.7; Coruna tied to theft from over 42,000 devices.
  • Help Net SecurityInstagram ad, iOS 18.4.0–18.7.2, Keychain theft, and 660 domains.
Vendors
Apple
Products
iPhoneiOSSafari
Threat actors
DeadTag
Malware
DarkSwordCorunaPegasusAdFection
Organizations
iVerifyReport URIGoogle Threat Intelligence Group
Countries
CanadaAustralia

Coverage

oldest first · one row per article · UTC
  1. · 1d ago CyberScoopFirst report

    iVerify says spyware infections are reaching people without public profiles

    The firm reports 1.07 infections per 1,000 iOS consumer scans in 2026, with three in four detections tied to criminal credential and cryptocurrency theft.

  2. · 1d ago The Record

    Criminal spyware kits infect ordinary iPhone users at scale, iVerify says

    iVerify found 1.07 spyware infections per 1,000 consumer scans, mostly Coruna and DarkSword rather than mercenary tools.

  3. · 15h ago Help Net Security

    Leaked DarkSword and Coruna kits infect employee iPhones

    One DarkSword chain started from an Instagram ad and targeted iOS 18.4.0 through 18.7.2 to steal Keychain data and crypto.