NEW 2026 Advanced Mobile Threat Report is live. See what we found.

iVerify Advanced Mobile threat report 2026

From Nation-State to Credential Thieves

How iOS exploit kits and Android malware went from targeted to wide-net. Our 2026 report shows what changed and what security teams should do now.

Read the full report

1.07

iOS infections per 1,000 consumer devices

75%

of detections were criminal, not state- sponsored

100%

of enterprise detections from criminal actors were rank- and-file employees

Prevalence figures describe the population iVerify monitors, not all iPhones, and are reported at the conservative lower end of our estimate

About the Report

The economics of iPhone exploitation just broke

For more than a decade, a working iOS exploit chain took rare skills, months of work, and millions of dollars to build. It was used sparingly against a short list of journalists, dissidents, and officials, and most enterprises left phones out of their detection and response programs.

In 2026, that changed. The exposure of DarkSword and Coruna in March, and the leak of DarkSword on GitHub, put government-grade iOS exploits in criminal hands. Attackers delivered them through online ads, reached ordinary employees, and erased their traces before defenders could respond. Android faced the same shift, with cheap, ready-made kits that let criminals take over phones remotely.

Who the report is for: CISOs, SOC teams, threat hunters, and security architects responsible for the phones that touch corporate data, including BYOD fleets.

For more than a decade, a working iOS exploit chain took rare skills, months of work and millions of dollars to build. It was used sparingly against a short list of journalists, dissidents and officials, and most enterprises left phones out of their detection and response programs.

In 2026 that changed. The exposure of DarkSword and Coruna in March, and the leak of DarkSword on GitHub, put government-grade iOS exploits in criminal hands. Attackers delivered them through online ads, reached ordinary employees and erased their traces before defenders could respond. Android faced the same shift, with cheap, ready-made kits that let criminals take over phones remotely.

Who it's for: CISOs, SOC teams, threat hunters and security architects responsible for the phones that touch corporate data, including BYOD fleets.

What's inside

State-grade tools, criminal scale

Prevalence: ~1 in 900

Who is being targeted

Delivery: half-click attacks through ads & forgotten web code

The App Store: an exploit toolkit inside an approved app

Blast radius: each compromise exposes more

Android: the year of the RAT

Detection: less evidence means defenders must be on the device

Recommendations

Security assumptions that no longer hold

Key Findings

What we found

Section 01

Leaked toolkits went mass-market

The exposure of DarkSword and Coruna put government-grade iOS exploits in criminal hands. Criminal groups have since forked the code into new variants, including the P7 variant iVerify uncovered on a financial institution employee's phone.

Section 04

Ads now deliver exploits, no click required

Targeted display ads can launch half-click attacks, where the exploit starts the moment an ad renders. iVerify recorded one served on Instagram while the user was simply scrolling.

Section 03

Criminals, not states

75% of this year's detections were criminals stealing credentials and cryptocurrency. In every enterprise case we confirmed, the person affected was an employee below managing director level.

Section 05

An exploitation toolkit inside an App Store app

FomoPeek, distributed through Apple's App Store, carried a hidden toolkit that could escape the iOS sandbox and steal from other apps. "Only install from the App Store" is no longer a sufficient policy.

Section 07

Android runs on cheap kits

Remote access trojans such as HyperRat, Cellik, and Octagon take over phones by abusing Accessibility Services, with no exploit needed. Google Play Protect flagged fewer than half of the Android devices where iVerify found a malicious app.

Section 08

Infections are silent, and forensics is losing its value

Attackers clean up aggressively and traces age off devices fast. To our knowledge, no device we confirmed as infected with DarkSword or Coruna received an Apple threat notification.

Recommendations

What security teams should do now

Treat employee phones as a front-line target, on par with laptops and servers.

Learn More

01

Plan for mass campaigns, not only targeted ones
Prepare for criminal campaigns against ordinary employees, not just state-sponsored attacks on executives or other high-risk staff.

02

Extend mobile security beyond a short list of leaders
Ordinary staff are getting caught on iPhone and Android alike, so protection cannot stop at a short list of travelers or leaders.

03

Close the patching and sideloading gaps
Require iOS and Android updates and security patches, and restrict sideloading on Android.

04

Get on the device
Rely on EDR running on the phone, not on post-incident forensics or Apple threat notifications alone.

05

Make device sourcing a security decision
Buy phones from trusted channels. Some budget Android devices arrive with malware preinstalled.

Related Reading

Go deeper

Nov 10, 2026

Half-Click Attacks: How Online Ads Now Deliver iPhone Exploits

Spencer

Parker

FomoPeek and the false sense of security

Nov 9, 2026

An Exploit Inside an App Store App: What FomoPeek Means for "App Store Only" Policies

Spencer

Parker

Nov 6, 2026

Android RATs for Rent: Five Remote Access Trojans and the $150-a-Month Phone Takeover

From Nation-State to Credential Thieves