Cybercriminals are increasingly infecting regular people with spyware

Cybercriminals are infecting devices on a large scale with spyware, increasingly compromising systems belonging to average people, according to a new report from the threat hunting firm iVerify.

The company found a rate of 1.07 spyware infections per 1,000 consumer scans of the startup’s free online checks.  

The security firm reported a lower rate of infections for enterprises, detecting .7 infections per 1,000 scans, a disparity iVerify attributed to enterprises’ enforced patching, on-device detection and network security controls.

Company co-founder Rocky Cole declined to say exactly how many consumer devices the firm tested, but said hundreds of thousands were scanned. An average Fortune 500 company experiences about 65 infections per year on its devices, he said.

Notably, a large number of enterprise employees found with infected devices were rank and file workers as opposed to top executives.

“The takeaway is that this is the year that iOS spyware went mainstream and became everyone's problem,” Cole said. “The number one threat actor using spyware targeting iPhones these days is not governments; it's just cyber criminals, and it's a problem that is indiscriminate.”

Many of the device infections iVerify detected were used for credential and crypto theft as opposed to the more politically driven abuses often seen when advanced commercial spyware is deployed.

Attacks were carried out by bad actors using leaked iOS exploit toolkits to “work at scale, delivering attacks through online ads, reaching ordinary employees, and erasing their traces before defenders could respond,” according to the iVerify report.

About 75% of detections involved criminal actors deploying Coruna or DarkSword exploit kits, the report said. The other 25% were infected by mercenary spyware such as Pegasus.

DarkSword is an advanced, full-chain JavaScript-based iOS exploit kit and spyware framework first made public in March.

Deployed as a “watering hole” attack, DarkSword allows users to be infected without clicking on a link. Simply visiting a compromised website through a web browser can trigger the attack.

Coruna is also delivered via web-based attacks, where people visiting malicious sites trigger WebKit and kernel vulnerabilities. The spyware framework was purloined from a defense contractor and has been used by cybercriminals to facilitate the theft of cryptocurrency from over 42,000 iOS devices using fake Chinese-language financial websites.

The Google Threat Intelligence Group first discovered the Coruna exploit kit in February 2025 and it slowly proliferated across last year. 

It has been directly tied to the actions of a former L3Harris Trenchant executive who pleaded guilty to stealing exploits and selling them on the black market in exchange for crypto payments. The executive, Peter Williams, was sentenced to seven years in prison in February 2026.

As with DarkSword, iVerify’s report said, Coruna is part of a “broader trend where mobile exploit frameworks… have shifted from rare, highly restricted intelligence operations into wider circulation.”

Owners of the devices infected with DarkSword and Coruna did not receive Apple threat notifications, the report said. Both exploit frameworks offer the same level of phone takeover as advanced commercial spyware brands like the zero-click Pegasus exploits and can expose messages, photos, emails and turn on microphones and cameras. The difference is that a broad population can access DarkSword and Coruna, whereas Pegasus and other commercial brands are exclusively sold to nation-state clients.

“One in 900 is a dragnet number, not a targeting number,” Nic Adams, co-founder and CEO of cyberkinetics company 0rcus said about the survey’s infection rate. “Mercenary spyware was built as a scalpel — now it’s being used as a net.”

Android is confronting a similar shift, the report said, as a large supply of inexpensive and turnkey spyware kits are letting bad actors easily take over phones from afar.

“The primary goal of these attacks isn't to steal intellectual property or get a leg up in trade negotiations — it's just cybercrime. Every single employee and every single person is potentially at risk,” Cole said. 

The firm’s researchers had expected to find a decline in the rate of detected spyware infections this year since the number of average consumers using the free device checks quadrupled, Cole said. Two years ago, many of the people getting their devices checked were elites with reasons to suspect potential spyware. 

An iVerify report published in December 2024 found Pegasus infections on 2.5 per 1,000 devices scanned. Coruna and DarkSword were not in the marketplace at the time and nation-state sponsored attacks using advanced commercial spyware were seen as by far the predominant threat. .

“Businesses need to update their threat models to stop focusing on VIPs and just assume this is a problem that everyone in the organization has to tackle,” Cole said.