“Conventional guidance on spyware risk focused on people with a public profile, a sensitive job or a role that put them on a government’s radar,” iVerify said — and its new findings show that conventional guidance is lagging reality.
iVerify: spyware reaching ordinary people
iVerify’s report, published Tuesday and summarized for CyberScoop, documents a visible shift in who is receiving Apple threat notifications and who is showing up in detections. The company cited cases in which notifications went to people without public profiles or sensitive jobs: children of a city bus driver and a stay-at-home mom in Ottawa, and a limousine driver in Australia. “None of them had a public profile, a sensitive job or an obvious connection to anyone worth spying on,” iVerify wrote, using those examples to argue the threat now “reach[es] people who had no reason to expect it.”
AdFection and the rise of indiscriminate delivery
Recent revelations about the AdFection spyware attacks illustrate how broadly some campaigns now operate: according to reporting cited in iVerify’s summary, AdFection could infect anyone visiting a website that had advertising on it. That delivery model — infecting users via ad-laden pages — aligns with iVerify’s broader finding that attackers are increasingly able to reach ordinary users, not just high-value targets.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageApple Threat Notifications and detection patterns
iVerify examined customer infections and Apple’s threat notifications and reported that the overall rate of spyware infections held relatively steady in 2026 at 1.07 infections per 1,000 iOS consumer scans. The company also reported that it did not observe devices infected by the DarkSword or Coruna iOS exploit kits among users who received Apple threat notifications, a pattern iVerify says “suggests that the tech giant might be overly focused on nation-state threats and well-known commercial mercenary spyware like NSO Group’s Pegasus.”
Criminal mass attacks, credentials and cryptocurrency
Rocky Cole, co-founder of iVerify, characterized most detections in 2026 as mass, criminal operations. “The vast majority of our detections were mass attacks by criminal groups looking to do purely criminal things,” he said. iVerify’s report quantified that as well: “Three in four of this year’s detections were criminal adversaries stealing credentials and cryptocurrency, not state-sponsored actors.” The report added a practical observation about value: for criminals seeking credentials to sell on black markets, an executive credential is “not necessarily more valuable than a system administrator or even an average employee.”
What this means for enterprises, end users, and criminal groups
- Enterprises and security teams — iVerify warned that “for an enterprise, the employees most likely to be hit look much more like the limousine driver than like the CEO.” Organizations therefore face a risk profile in which nonexecutive staff and contractors may be more exposed than often-assumed high-profile targets.
- End users and consumers — the report’s concrete examples (children of a city bus driver, a stay-at-home mom, a limousine driver) underline that ordinary household members and service workers are receiving Apple threat notifications and can be victims of spyware campaigns that do not discriminate by public profile.
- Criminal adversaries — iVerify’s findings show criminal groups favor mass attacks aimed at harvesting credentials and cryptocurrency, rather than narrowly tailored surveillance. That operational choice raises the odds that lower-profile, less-secure accounts will be harvested and monetized.
iVerify’s analysis and the AdFection revelations converge on a clear point: spyware’s target set is broadening. The company’s data — a steady infection rate of 1.07 per 1,000 iOS scans, three-in-four detections tied to criminal actors, and examples of notifications to non-public figures — all frame a threat that is increasingly indifferent to stature or official role. At the same time, iVerify’s observation that Apple threat notifications did not track certain exploit-kit infections raises a practical question for defenders and platform owners alike: are detection and notification systems tuned to the right adversaries?
Read the original report at CyberScoop: https://cyberscoop.com/spyware-attacks-trend-everyday-people-iverify-report/
