Overview
- iVerify's Advanced Mobile Threat Report, published Nov. 10, found about 1.07 infections per 1,000 consumer iOS scans and said three quarters of detections were criminal campaigns rather than state operators.
- Researchers say two exploit chains disclosed in March 2026, Coruna and DarkSword, were reused or modified by criminals after code and details were published, lowering the technical bar to powerful iPhone compromises.
- Attackers are delivering exploits without user clicks by loading malicious ads, reusing expired or hijacked analytics scripts embedded in legitimate sites, and slipping exploit toolkits into App Store apps such as FomoPeek, which links to roughly $580,000 in stolen USDT.
- Confirmed Coruna and DarkSword infections examined by researchers did not trigger Apple's targeted threat notifications, and newer variants often erase logs or avoid persistence, making compromises harder to detect and investigate.
- The practical defense is timely iOS updates, limiting exposure to third‑party ad and analytics code, restricting app sources, and expanding mobile monitoring beyond executives to protect employees and corporate networks from credential theft.