Criminal Campaigns Accounted for 75% of Spyware Detections in One Study

Criminal campaigns accounted for 75% of spyware detections in a study published Nov. 10, highlighting the risk that exploit kits pose to crypto data on vulnerable iPhones.

Coruna and DarkSword exploit kits have been used in campaigns that reach targets through online ads, watering-hole websites and phishing lures. On vulnerable phones, the kits can collect stored passwords, messages, photos and cryptocurrency-related information. The findings add to earlier coverage of the DarkSword iPhone threat.

The monitored-device estimate was 1.07 iOS infections per 1,000 consumer devices as of October 2026. The figure is a conservative lower-end estimate for those monitored devices, not a prevalence measure for all iPhones.

“We are confirming attacks every week,” said Rocky Cole, iVerify’s co-founder and COO.

The Apple and Google security advisories issued Nov. 9 did not link their updates to the Coruna or DarkSword campaigns. The advisories therefore do not establish that either update addressed those campaigns.

Trust Wallet’s Nov. 6 guidance urged iPhone users to install the latest iOS version supported by their devices. It also recommended Lockdown Mode for users unable to update and advised keeping recovery phrases out of Photos and Notes.