iVerify attributes 75% of its detections this year to criminal actors, with ordinary employees appearing in confirmed enterprise cases involving criminals.
The company released its Advanced Mobile Threat Report on November 10. It links the shift to wider criminal use of the Coruna and DarkSword iOS exploit kits for credential and cryptocurrency theft, including delivery through advertising and compromised websites.
Its conservative estimate of 1.07 infections per 1,000 consumer iOS devices, reported as of October 2026, describes the population iVerify monitors. It is not a prevalence estimate for all iPhones. The public summary does not specify the full sampling window or detection thresholds, so the figure should not be presented as a count of phones actively infected at one moment.
For organizations, iVerify recommends extending mobile protection beyond executives, enforcing operating-system updates and security patches, and restricting Android sideloading. Its findings also support including ordinary employees’ phones in incident-response planning.
