Criminals Are Using Government-Grade Spyware to Hack iPhones: How to Protect Your Device

Cybercriminals are increasingly using sophisticated iPhone spyware tools originally associated with government surveillance operations. A new iVerify security report reveals how leaked iOS exploits, malicious advertisements and compromised websites are helping attackers target ordinary iPhone users, steal passwords and access sensitive personal information.

iPhone users are facing a growing cybersecurity threat as advanced spyware technologies once linked to government-backed surveillance campaigns are increasingly appearing in financially motivated cyberattacks.

According to mobile security company iVerify's Advanced Mobile Threat Report 2026, published on November 10, sophisticated spyware attacks are no longer limited to politicians, journalists, business executives or other high-profile individuals. Cybercriminals are increasingly using advanced exploitation techniques against ordinary consumers and employees.

The report identified approximately 1.07 spyware infections per 1,000 consumer iOS scans, equivalent to roughly one infection for every 900 scans. When enterprise devices were included, the detection rate declined to 0.7 infections per 1,000 scans.

However, these figures represent iVerify's user base rather than the entire global iPhone population. The company also reported that its consumer user base had more than tripled since early 2025, although it did not disclose the total number of scans or confirmed infections.

One particularly concerning finding was that every enterprise infection associated with a criminal campaign involved an ordinary employee rather than a senior executive.
Leaked iPhone Exploits Are Helping Cybercriminals Access Devices
One of the biggest developments highlighted in the report is the growing availability of sophisticated iPhone exploitation tools.

Two exploit kits, known as Coruna and DarkSword, have attracted particular attention after researchers publicly disclosed details about them in March 2026.

Google's Threat Intelligence Group identified Coruna as a collection of 23 exploits organised into five attack chains. The toolkit targeted Apple devices running iOS 13 through iOS 17.2.1.

Researchers initially observed Coruna being used by a customer of a commercial surveillance vendor. It was subsequently linked to a suspected Russian espionage group targeting Ukrainian websites during 2025.

However, the toolkit later appeared in financially motivated cyberattacks operated by a group in China.

Google researchers could not establish precisely how the exploitation technology moved between different operators. Nevertheless, the findings demonstrated how advanced surveillance capabilities can spread beyond their original users.

DarkSword followed a similar pattern. Google, Lookout and iVerify researchers disclosed the exploit chain on March 18, 2026, after identifying its use by surveillance vendors and suspected state-sponsored attackers.

The toolkit targeted iPhones running iOS 18.4 through iOS 18.7 and exploited six vulnerabilities to compromise devices and collect sensitive information.

Apple subsequently addressed the vulnerabilities through security updates. Google confirmed that all six vulnerabilities had been patched by iOS 26.3.

The public disclosure of these exploit techniques has created additional opportunities for criminals to develop modified versions and reuse previously discovered vulnerabilities.

According to iVerify, newer DarkSword variants have demonstrated the ability to collect additional passwords, private messages, photographs and cryptocurrency wallet information.

Importantly, the documented attacks do not establish that these same exploit chains can compromise fully updated iPhones.
Malicious Advertisements Can Hack iPhones Without Clicking
One of the most concerning findings in iVerify's report involves attacks delivered through online advertisements.

Researchers documented a case involving an ordinary iPhone user who encountered two separate DarkSword attacks while browsing the internet.

The first incident reportedly began when a malicious advertisement loaded during an Instagram browsing session.

The victim did not click the advertisement or intentionally download anything. However, the exploit began executing because the device was running vulnerable software.

A second attack occurred later when the same individual followed a link. Researchers identified a different DarkSword variant associated with another threat actor. Both incidents appeared to have financial motives, particularly cryptocurrency theft.

This technique is commonly described as a zero-click or drive-by attack, although iVerify's report uses the term half-click attack for the advertising-based incident.

It demonstrates how cybercriminals can potentially exploit vulnerabilities without requiring users to interact directly with suspicious advertisements.

Advertising networks can also help attackers narrow their targets using information such as device type, operating system version, geographical location and user interests.

This allows malicious advertisements to be delivered to selected audiences using vulnerable devices.

As a result, visiting a legitimate website or scrolling through social media may expose an unpatched iPhone to an exploit if malicious advertising content is delivered.
Hackers Are Compromising Legitimate Websites to Spread Spyware
Cybercriminals are also finding ways to distribute spyware through websites that users may otherwise consider trustworthy.

Researchers uncovered a campaign in October involving an expired analytics domain that had been used to redirect visitors from thousands of online stores towards malicious servers.

The compromised infrastructure reportedly distributed both Coruna and DarkSword exploit kits.

The attack relied on abandoned tracking scripts that remained embedded in legitimate websites.

This means users did not necessarily need to visit fake shopping websites or suspicious links to encounter malicious content.

Instead, compromised third-party scripts could redirect visitors towards attacker-controlled infrastructure.

The incident highlights the security risks associated with outdated website integrations, abandoned domains and third-party advertising or analytics services.
App Store Security: How a Cryptocurrency App Distributed Spyware
Apple's App Store provides security protections designed to prevent malicious applications from reaching users. However, iVerify's report highlights a case demonstrating that these safeguards cannot guarantee that every approved application is completely safe.

The report discusses FomoPeek, a cryptocurrency monitoring application that reportedly contained a hidden exploitation toolkit in versions distributed through Apple's App Store in September 2026.

Security researchers from SlowMist and OKX identified malicious components in versions 1.1 and 1.2.

According to their findings, the toolkit could exploit iOS vulnerabilities, escape the application sandbox and access information belonging to other applications.

The affected versions reportedly appeared on September 9 and September 12. An update released on September 17 removed the malicious components.

SlowMist's investigation also traced approximately $580,000 in stolen USDT to a cryptocurrency address associated with the operation.

Researchers demonstrated that the toolkit could collect application data in a controlled environment, including information stored in Apple Notes.

However, the findings do not establish that every supported exploit successfully worked or that every cryptocurrency wallet targeted by the operation was compromised.

The FomoPeek incident represents a documented security case rather than evidence that malicious applications are widespread across Apple's App Store.
Why Detecting iPhone Spyware Is Becoming More Difficult
Another major concern highlighted by iVerify is the ability of newer spyware variants to remove evidence of their activity.

Some DarkSword variants can collect stored credentials and other sensitive information without maintaining a persistent infection.

They can also remove logs and temporary working files, making it more difficult for security researchers to reconstruct an attack after it has finished.

This creates additional risks for organisations whose employees use personal iPhones for professional activities.

If an employee's device is compromised, attackers may obtain credentials connected to corporate email accounts, messaging services and other workplace platforms.

Those credentials could subsequently be used to access business accounts and systems beyond the original infected device.

According to iVerify, none of the devices it confirmed as infected with DarkSword or Coruna received an Apple threat notification.

However, Apple's threat notification system is designed specifically to alert individuals believed to have been targeted by mercenary spyware because of their identity or activities.

It is not intended to detect and notify every person affected by ordinary cybercrime or every form of malware.

Therefore, the absence of an Apple warning does not prove that an iPhone is free from spyware or that its security systems have failed.
Is Artificial Intelligence Making Spyware More Dangerous?
The report also raises concerns about artificial intelligence accelerating the development and modification of cyberattack tools.

AI technologies can help developers analyse existing code, identify potential vulnerabilities and adapt previously developed exploits.

However, iVerify's testing found limitations in the effectiveness of suspected AI-assisted attempts to modify DarkSword for newer iOS versions.

Researchers examined attempts to adapt the toolkit for more recent operating systems, but none successfully exploited the devices included in their tests.

This suggests that AI may make certain stages of exploit development easier, but it does not automatically allow attackers to bypass modern security protections.

As AI capabilities continue to evolve, cybersecurity researchers and technology companies will need to monitor how these tools influence the development of sophisticated malware.
How to Protect Your iPhone From Spyware Attacks
Keeping iOS updated remains one of the most effective ways to protect an iPhone against the vulnerabilities identified in the report.

Apple regularly releases security updates to address weaknesses that attackers may exploit.

Here are some important steps iPhone users should follow.

1. Keep Your iPhone Updated

Open Settings, select General and tap Software Update to check whether a newer iOS version is available.

Installing the latest supported security updates helps close vulnerabilities targeted by exploit kits such as Coruna and DarkSword.

2. Enable Automatic Updates

Users can enable automatic iOS updates under Settings to ensure that important security fixes are installed without having to check manually.

3. Download Apps From Trusted Sources

Install applications only from trusted sources and carefully examine the developer's identity before downloading unfamiliar apps.

Although Apple's App Store provides security protections, the FomoPeek incident demonstrates that users should remain cautious.

4. Use Strong Passwords and Two-Factor Authentication

Use unique passwords for important accounts, including email, banking, social media and cryptocurrency services.

Enable two-factor authentication wherever possible to add another layer of account protection.

5. Consider Apple's Lockdown Mode

Apple's Lockdown Mode is designed for individuals who may face sophisticated and highly targeted cyberattacks.

The feature restricts certain applications, website functions and device capabilities to reduce potential attack surfaces.

Most iPhone users do not need to enable it, but it may be useful for people facing unusually serious surveillance threats.

6. Be Careful With Suspicious Links and Advertisements

Avoid unfamiliar websites, unexpected downloads and suspicious advertisements.

However, users should understand that some sophisticated attacks may not require clicking an advertisement or downloading an application.
iPhone Spyware Threats Are Expanding Beyond High-Profile Targets
The findings from iVerify's Advanced Mobile Threat Report 2026 highlight an important change in the cybersecurity landscape.

Sophisticated exploitation techniques are increasingly moving beyond their original surveillance applications and appearing in financially motivated criminal campaigns.

Ordinary consumers, employees and cryptocurrency users could become targets when attackers gain access to vulnerable devices.

For businesses, the growing threat also raises questions about mobile security policies, employee devices and the protection of corporate credentials.

Although the findings do not suggest that every iPhone is vulnerable or that fully updated devices can be easily compromised, they demonstrate why regular security updates and stronger mobile protection practices are increasingly important.

As spyware tools become more accessible to cybercriminals, keeping iPhones updated and protecting sensitive account information will remain essential for reducing the risk of digital attacks.