Criminals are using government-grade spyware to infect iPhones

Advanced spyware, typically used for government surveillance, is now being exploited by cybercriminals targeting ordinary iPhone users, according to a new security analysis from iVerify. The report, released November 10, 2026, reveals that one in 900 consumer iOS devices is affected by spyware infections, a rate that drops to one in 1,000 when enterprise devices are factored in.

The majority of these infections stem from two exploit kits: Coruna and DarkSword. Coruna, disclosed in March 2026, consists of 23 exploits across five attack chains targeting iOS versions 13 to 17.2.1. Initially used by a surveillance vendor's client and a suspected Russian espionage group, Coruna later resurfaced in widespread attacks orchestrated by a financially motivated Chinese group.

DarkSword, similarly, was disclosed by Google, Lookout, and iVerify on March 18, 2026, targeting iPhones running iOS 18.4 through iOS 18.7. This toolkit exploits six vulnerabilities to compromise devices and extract sensitive data. Apple patched these vulnerabilities through subsequent updates, with Google confirming all six had been fixed in iOS 26.3.

The report emphasizes that these attacks do not confirm the ability of the same exploit chains to compromise fully updated iPhones. However, the release of DarkSword code has enabled criminals to develop their own variants, making it easier to create sophisticated attack tools without needing to discover vulnerabilities themselves.

One notable case involved a person browsing Instagram when a malicious advertisement loaded, initiating a DarkSword attack. Another attack followed after the person clicked a link, both intended to steal cryptocurrency. This type of attack, known as a half-click attack, occurs when malicious code begins executing when an advertisement loads, without requiring user interaction.

Advertisers can target specific vulnerabilities based on device type, iOS version, location, and interests, delivering exploits directly to iPhones running vulnerable software. Additionally, criminals have hijacked legitimate websites using abandoned tracking scripts, redirecting visitors from thousands of online stores to malicious servers distributing DarkSword and Coruna.

The report also uncovers FomoPeek, a cryptocurrency monitoring app compromised in September 2026, capable of exploiting iOS vulnerabilities, escaping the app sandbox, and accessing data from other apps. Apple's review process may not guarantee every approved app is free from malicious code, as FomoPeek's malicious components were removed only after they were discovered.