Skip to navigation

Threat reportMalwareTL-2026-5640

iVerify Advanced Mobile Threat Report 2026: Mobile Spyware Shifts Toward Everyday Users as Criminal Groups Fork Leaked iOS Exploit Kits for Credential and Crypto Theft

mediumACTIVE

iVerify's advanced mobile threat report (published 2026-11-10) finds that 75% of 2026 detections were criminal actors stealing credentials and cryptocurrency rather than state-sponsored operators, with infections reaching ordinary employees and consumers. The infection rate held at 1.07 per 1,000 iOS consumer scans.

Key facts

IdentifiersTL-2026-5640
Also known asiVerify Advanced Mobile Threat Report 2026
SeverityMEDIUM
Affected productsApple iOS; Google Android
MalwareCandiru, Cellik, Coruna, DarkSword, FomoPeek, HyperRat, Octagon, P7 DarkSword
ToolsControlium
MITRE ATT&CK techniquesT1203 Exploitation for Client Execution, T1533 Data from Local System, T1555 Credentials from Password Stores, T1664 Exploitation for Initial Access
MotivationFINANCIAL
Target sectorsfinance, enterprise, consumer, news - media
Target regionsGlobal, North America, australia
Detection rules9 (1 shown free)
Sources7 cited sources

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5640 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Mobile Threat Defense Alert for DarkSword, Coruna, FomoPeek, Android RATs or Candiru

Alerts when a mobile threat defense or EDR feed reports a named TL-2026-5640 family (DarkSword, Coruna, P7 DarkSword fork, FomoPeek, HyperRat, Cellik, Octagon, Candiru) or a sandbox-escape, jailbreak or Accessibility Services abuse category. These map to exploitation for privilege escalation, credential store theft, local data collection and anti-forensic cleanup on the handset.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1068, T1555, T1533, T1070
  • Data sources: mobile_threat_defense, m365defender_alerts, AlertInfo, AlertEvidence
  • Severity: high
  • Confidence: high

Splunk SPL

index=mtd sourcetype="mtd:threat_event" earliest=-24h
```comment: sourcetype and fields are deployment specific, map to your MTD or MDM TA```
| search threat_name IN ("*DarkSword*","*Coruna*","*P7 DarkSword*","*FomoPeek*","*HyperRat*","*Cellik*","*Octagon*","*Candiru*") OR threat_category IN ("sandbox_escape","jailbreak","accessibility_abuse","exploit_kit")
| eval family=case(like(lower(threat_name),"%darksword%"),"DarkSword",like(lower(threat_name),"%coruna%"),"Coruna",like(lower(threat_name),"%fomopeek%"),"FomoPeek",like(lower(threat_name),"%hyperrat%") OR like(lower(threat_name),"%cellik%") OR like(lower(threat_name),"%octagon%"),"Android_Accessibility_RAT",like(lower(threat_name),"%candiru%"),"Candiru",true(),"category_match")
| stats count as alerts min(_time) as first_seen max(_time) as last_seen values(threat_name) as threats values(threat_category) as categories by user, device_id, os, family
| convert ctime(first_seen) ctime(last_seen)
| sort - alerts

Microsoft KQL

AlertInfo
| where Timestamp > ago(24h)
| where Title has_any ("DarkSword","Coruna","P7 DarkSword","FomoPeek","HyperRat","Cellik","Octagon","Candiru") or Title has_any ("jailbreak","sandbox escape","accessibility service")
| join kind=inner (AlertEvidence | where Timestamp > ago(24h) | where EntityType in ("Machine","User") | project AlertId, DeviceName, AccountName, EntityType) on AlertId
| project Timestamp, AlertId, Title, Severity, Category, DeviceName, AccountName
| order by Timestamp desc

Sigma

title: Mobile Threat Alert for DarkSword Coruna FomoPeek HyperRat Cellik Octagon or Candiru
id: 7a1d9e04-2b63-4c85-a3f1-0d84b6e5c702
status: experimental
description: Detects Defender or MTD alerts naming iOS exploit kits, the FomoPeek App Store app, Android Accessibility RATs or Candiru spyware (TL-2026-5640).
references:
    - https://www.iverify.com/advanced-mobile-threat-report-2026
    - https://cyberscoop.com/spyware-attacks-trend-everyday-people-iverify-report/
    - https://cyberscoop.com/adfection-zero-click-spyware-discover-tech/
author: Threadlinqs Team
date: 2026/11/10
tags:
    - attack.privilege-escalation
    - attack.t1068
    - attack.credential-access
    - attack.t1555
    - attack.collection
    - attack.t1533
    - attack.defense-evasion
    - attack.t1070
logsource:
    product: m365defender
    service: alerts
detection:
    selection_family:
        Title|contains:
        - DarkSword
        - Coruna
        - P7 DarkSword
        - FomoPeek
        - HyperRat
        - Cellik
        - Octagon
        - Candiru
    selection_behavior:
        Title|contains:
        - jailbreak
        - sandbox escape
        - accessibility service
    condition: 1 of selection_*
falsepositives:
    - Security research or red-team devices running named samples
    - Test alerts from MTD vendor validation
level: high

Known false positives:

  • Security research or red-team devices running named samples
  • MTD vendor validation test alerts

Tuning notes: Map sourcetype and fields to your MTD or MDM feed. Route alerts for finance-sector and BYOD users first. Traces age off phones quickly, so alert on first sighting and do not wait for forensic confirmation.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Web or DNS Contact with Community-Observed Sibling Malvertising Infrastructure · unlock with TL Creds
  • Managed iOS or Android Device Reported Jailbroken or Compromised by Intune · unlock with TL Creds
  • Mobile Device Periodic Low-Jitter Beaconing to a Single Destination · unlock with TL Creds
  • Apple Lookalike Domain on .top or .xyz Contacted via Web Proxy · unlock with TL Creds
  • Risky Successful Sign-In from Mobile Device After Credential Theft · unlock with TL Creds
  • DNS Query to Community-Observed Sibling Malvertising C2 Domains · unlock with TL Creds
  • Mobile Device Contact with Discover-Tech / Controlium AdFection Ad-Delivery Infrastructure · unlock with TL Creds
  • Mobile Device Large Upload to Rare Destination (Spyware Exfiltration Receiver) · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-5640.

12 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

iVerify's 2026 advanced mobile threat report, built from customer detections and Apple threat notification cases, describes a shift from narrowly targeted state spyware toward mass criminal campaigns against ordinary users. Three in four of this year's detections were criminal adversaries stealing credentials and cryptocurrency. The iOS spyware infection rate held steady at 1.07 per 1,000 consumer devices (reported by iVerify as the conservative low end, roughly 1 in 900). All confirmed enterprise detections attributed to criminal actors involved employees below managing director level. iVerify co-founder Rocky Cole stated that the vast majority of detections were mass attacks by criminal groups and that an executive credential is not necessarily more valuable than a system administrator's.

The report ties part of the shift to the leak and reuse of iOS exploit kits. DarkSword and Coruna were exposed in March 2026 (Google GTIG, iVerify, Lookout); DarkSword code was later leaked on GitHub, and iVerify found a criminal fork it calls the P7 variant on the phone of a financial institution employee. iVerify also reports FomoPeek, an iOS app distributed through the Apple App Store that contained a hidden exploit toolkit able to escape the iOS sandbox and steal data from other apps, and the Android RATs HyperRat, Cellik and Octagon, which take over devices by abusing Accessibility Services without an exploit. Google Play Protect flagged fewer than half of the Android devices on which iVerify found a malicious app.

Infection vectors named by iVerify include online display ads (including targeted ads and 'half-click' exploits that run when an ad renders, one of which iVerify recorded being served on Instagram while a user scrolled), forgotten or outdated web code, App Store apps, Android sideloading and malware preinstalled on some budget Android devices. Attackers clean up aggressively and traces age off devices quickly, limiting forensic value. iVerify observed Apple threat notifications reaching people with no public profile or sensitive role (for example children of a city bus driver and a stay-at-home parent in Ottawa, and a limousine driver in Australia), and, to its knowledge, no device confirmed infected with DarkSword or Coruna received an Apple notification.

The companion CyberScoop coverage cites the AdFection technique documented by Citizen Lab (October 2026): Israeli ad-tech firm Discover-Tech's Controlium platform fingerprints devices and directs them to Candiru servers the moment an ad renders; at least 45 Al Jazeera devices were targeted. The sources name no CVEs, versions or network IOCs for the report-level findings; DarkSword reporting (CyberScoop, 2026-03-18) describes a WebKit compromise with WebGPU used as a sandbox-escape pivot, attributed by Google to UNC6353 and linked to UNC6748 and PARS Defense. Detection guidance from iVerify: plan for mass criminal campaigns, extend mobile protection beyond executives, enforce patching and restrict Android sideloading, deploy on-device EDR rather than relying on forensics or Apple notifications, and source devices from trusted channels.

MITRE ATT&CK techniques by tactic:

Execution

T1203 Exploitation for Client Execution

Collection

T1533 Data from Local System

Credential Access

T1555 Credentials from Password Stores

initial-access

T1664 Exploitation for Initial Access

Remediation

Patches

  • Update iOS to a release containing the DarkSword/Coruna fixes (iOS 26.3 or later per CyberScoop)

Immediate actions

  • Apply current iOS and Android security updates on all managed and BYOD devices (DarkSword vulnerabilities are patched in iOS 26.3 and later, per CyberScoop)
  • Enable Lockdown Mode for users at elevated risk
  • Block targeted/programmatic ad delivery at network gateways where feasible (Citizen Lab recommendation for AdFection)

Workarounds

  • Restrict Android sideloading
  • Restrict Accessibility Services grants to vetted apps on Android

Longer-term hardening

  • Deploy mobile EDR on employee phones rather than relying on forensics or Apple threat notifications
  • Extend mobile threat protection beyond executives and travelers to all employees, including BYOD fleets
  • Plan detection and response for mass criminal mobile campaigns, not only targeted state spyware
  • Source devices from trusted channels to avoid preinstalled malware

Affected and fixed versions

  • Apple — iOS
    Vulnerable versions: iOS 18 and earlier (DarkSword/Coruna exposure per CyberScoop)
    Fixed in: iOS 26.3
  • Google — Android
    Vulnerable versions: Devices with sideloaded apps, Accessibility Services abuse, or preinstalled malware

Timeline

  • DARK CARTOGRAPHER activity dates to 2019 (year-level date); it later used Discover-Tech infrastructure, per CyberScoop's AdFection coverage.
  • Discover-Tech registered in 2020 (year-level date); it facilitated mercenary spyware delivery from at least 2024.
  • DarkSword exploit kit in use since at least November 2025 per Lookout (month-level date); Google began investigating in late 2025.
  • DarkSword exposed by Google, Lookout and iVerify as the second mass iOS exploit kit of March 2026 after Coruna; attributed by Google to UNC6353.
  • Between March and June 2026 Discover-Tech ads were observed on more than 120,000 websites and 70,000 mobile apps (date marks end of observation window).
  • Citizen Lab published AdFection findings: Candiru spyware delivered via Discover-Tech ads, at least 45 Al Jazeera devices targeted; Google and IAB Europe removed Discover-Tech.
  • iVerify published its advanced mobile threat report: 75% of 2026 detections criminal, infection rate 1.07 per 1,000 iOS consumer scans, P7 fork and FomoPeek documented.

Sources cited

Further reading

Drafted by the Threadlinqs research pipeline from 7 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats