# iVerify Advanced Mobile Threat Report 2026: Mobile Spyware Shifts Toward Everyday Users as Criminal Groups Fork Leaked iOS Exploit Kits for Credential and Crypto Theft

> iVerify's advanced mobile threat report (published 2026-11-10) finds that 75% of 2026 detections were criminal actors stealing credentials and cryptocurrency rather than state-sponsored operators, with infections reaching ordinary employees and consumers. The infection rate held at 1.07 per 1,000 iOS consumer scans.

- **Published:** 2026-11-10T11:33:09Z
- **Last reviewed:** 2026-11-10T11:33:09Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5640
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5640.png
- **ID:** TL-2026-5640
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 12

## Description

iVerify's 2026 advanced mobile threat report, built from customer detections and Apple threat notification cases, describes a shift from narrowly targeted state spyware toward mass criminal campaigns against ordinary users. Three in four of this year's detections were criminal adversaries stealing credentials and cryptocurrency. The iOS spyware infection rate held steady at 1.07 per 1,000 consumer devices (reported by iVerify as the conservative low end, roughly 1 in 900). All confirmed enterprise detections attributed to criminal actors involved employees below managing director level. iVerify co-founder Rocky Cole stated that the vast majority of detections were mass attacks by criminal groups and that an executive credential is not necessarily more valuable than a system administrator's.

The report ties part of the shift to the leak and reuse of iOS exploit kits. DarkSword and Coruna were exposed in March 2026 (Google GTIG, iVerify, Lookout); DarkSword code was later leaked on GitHub, and iVerify found a criminal fork it calls the P7 variant on the phone of a financial institution employee. iVerify also reports FomoPeek, an iOS app distributed through the Apple App Store that contained a hidden exploit toolkit able to escape the iOS sandbox and steal data from other apps, and the Android RATs HyperRat, Cellik and Octagon, which take over devices by abusing Accessibility Services without an exploit. Google Play Protect flagged fewer than half of the Android devices on which iVerify found a malicious app.

Infection vectors named by iVerify include online display ads (including targeted ads and 'half-click' exploits that run when an ad renders, one of which iVerify recorded being served on Instagram while a user scrolled), forgotten or outdated web code, App Store apps, Android sideloading and malware preinstalled on some budget Android devices. Attackers clean up aggressively and traces age off devices quickly, limiting forensic value. iVerify observed Apple threat notifications reaching people with no public profile or sensitive role (for example children of a city bus driver and a stay-at-home parent in Ottawa, and a limousine driver in Australia), and, to its knowledge, no device confirmed infected with DarkSword or Coruna received an Apple notification.

The companion CyberScoop coverage cites the AdFection technique documented by Citizen Lab (October 2026): Israeli ad-tech firm Discover-Tech's Controlium platform fingerprints devices and directs them to Candiru servers the moment an ad renders; at least 45 Al Jazeera devices were targeted. The sources name no CVEs, versions or network IOCs for the report-level findings; DarkSword reporting (CyberScoop, 2026-03-18) describes a WebKit compromise with WebGPU used as a sandbox-escape pivot, attributed by Google to UNC6353 and linked to UNC6748 and PARS Defense. Detection guidance from iVerify: plan for mass criminal campaigns, extend mobile protection beyond executives, enforce patching and restrict Android sideloading, deploy on-device EDR rather than relying on forensics or Apple notifications, and source devices from trusted channels.

## MITRE ATT&CK

- T1664 Exploitation for Initial Access
- T1203 Exploitation for Client Execution
- T1555 Credentials from Password Stores
- T1533 Data from Local System

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Mobile Threat Defense Alert for DarkSword, Coruna, FomoPeek, Android RATs or Candiru** (`TL-2026-5640-SPL-002`)

Alerts when a mobile threat defense or EDR feed reports a named TL-2026-5640 family (DarkSword, Coruna, P7 DarkSword fork, FomoPeek, HyperRat, Cellik, Octagon, Candiru) or a sandbox-escape, jailbreak or Accessibility Services abuse category. These map to exploitation for privilege escalation, credential store theft, local data collection and anti-forensic cleanup on the handset.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1068, T1555, T1533, T1070
- **Data sources:** mobile_threat_defense, m365defender_alerts, AlertInfo, AlertEvidence
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=mtd sourcetype="mtd:threat_event" earliest=-24h
```comment: sourcetype and fields are deployment specific, map to your MTD or MDM TA```
| search threat_name IN ("*DarkSword*","*Coruna*","*P7 DarkSword*","*FomoPeek*","*HyperRat*","*Cellik*","*Octagon*","*Candiru*") OR threat_category IN ("sandbox_escape","jailbreak","accessibility_abuse","exploit_kit")
| eval family=case(like(lower(threat_name),"%darksword%"),"DarkSword",like(lower(threat_name),"%coruna%"),"Coruna",like(lower(threat_name),"%fomopeek%"),"FomoPeek",like(lower(threat_name),"%hyperrat%") OR like(lower(threat_name),"%cellik%") OR like(lower(threat_name),"%octagon%"),"Android_Accessibility_RAT",like(lower(threat_name),"%candiru%"),"Candiru",true(),"category_match")
| stats count as alerts min(_time) as first_seen max(_time) as last_seen values(threat_name) as threats values(threat_category) as categories by user, device_id, os, family
| convert ctime(first_seen) ctime(last_seen)
| sort - alerts
````

### Microsoft KQL

```kql
AlertInfo
| where Timestamp > ago(24h)
| where Title has_any ("DarkSword","Coruna","P7 DarkSword","FomoPeek","HyperRat","Cellik","Octagon","Candiru") or Title has_any ("jailbreak","sandbox escape","accessibility service")
| join kind=inner (AlertEvidence | where Timestamp > ago(24h) | where EntityType in ("Machine","User") | project AlertId, DeviceName, AccountName, EntityType) on AlertId
| project Timestamp, AlertId, Title, Severity, Category, DeviceName, AccountName
| order by Timestamp desc
```

### Sigma

```yaml
title: Mobile Threat Alert for DarkSword Coruna FomoPeek HyperRat Cellik Octagon or Candiru
id: 7a1d9e04-2b63-4c85-a3f1-0d84b6e5c702
status: experimental
description: Detects Defender or MTD alerts naming iOS exploit kits, the FomoPeek App Store app, Android Accessibility RATs or Candiru spyware (TL-2026-5640).
references:
    - https://www.iverify.com/advanced-mobile-threat-report-2026
    - https://cyberscoop.com/spyware-attacks-trend-everyday-people-iverify-report/
    - https://cyberscoop.com/adfection-zero-click-spyware-discover-tech/
author: Threadlinqs Team
date: 2026/11/10
tags:
    - attack.privilege-escalation
    - attack.t1068
    - attack.credential-access
    - attack.t1555
    - attack.collection
    - attack.t1533
    - attack.defense-evasion
    - attack.t1070
logsource:
    product: m365defender
    service: alerts
detection:
    selection_family:
        Title|contains:
        - DarkSword
        - Coruna
        - P7 DarkSword
        - FomoPeek
        - HyperRat
        - Cellik
        - Octagon
        - Candiru
    selection_behavior:
        Title|contains:
        - jailbreak
        - sandbox escape
        - accessibility service
    condition: 1 of selection_*
falsepositives:
    - Security research or red-team devices running named samples
    - Test alerts from MTD vendor validation
level: high

```

**Known false positives:**

- Security research or red-team devices running named samples
- MTD vendor validation test alerts

**Tuning notes:** Map sourcetype and fields to your MTD or MDM feed. Route alerts for finance-sector and BYOD users first. Traces age off phones quickly, so alert on first sighting and do not wait for forensic confirmation.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Web or DNS Contact with Community-Observed Sibling Malvertising Infrastructure (locked: unlock with TL Creds)
- Managed iOS or Android Device Reported Jailbroken or Compromised by Intune (locked: unlock with TL Creds)
- Mobile Device Periodic Low-Jitter Beaconing to a Single Destination (locked: unlock with TL Creds)
- Apple Lookalike Domain on .top or .xyz Contacted via Web Proxy (locked: unlock with TL Creds)
- Risky Successful Sign-In from Mobile Device After Credential Theft (locked: unlock with TL Creds)
- DNS Query to Community-Observed Sibling Malvertising C2 Domains (locked: unlock with TL Creds)
- Mobile Device Contact with Discover-Tech / Controlium AdFection Ad-Delivery Infrastructure (locked: unlock with TL Creds)
- Mobile Device Large Upload to Rare Destination (Spyware Exfiltration Receiver) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [iVerify Advanced Mobile Threat Report 2026](https://www.iverify.com/advanced-mobile-threat-report-2026)
- [Spyware attacks trend toward hitting just about anyone (CyberScoop)](https://cyberscoop.com/spyware-attacks-trend-everyday-people-iverify-report/)
- [AdFection zero-click spyware via Discover-Tech ads (CyberScoop)](https://cyberscoop.com/adfection-zero-click-spyware-discover-tech/)
- [Second iOS exploit kit (DarkSword) emerges (CyberScoop)](https://cyberscoop.com/second-ios-exploit-kit-emerges-from-suspected-russian-hackers-using-possible-u-s-government-developed-tools/)
- [DarkSword: Researchers uncover another iOS exploit kit (Help Net Security)](https://www.helpnetsecurity.com/2026/03/19/darksword-ios-exploit-iphone/)
- [AdFection Turns Ad Impressions Into Zero-Click Spyware Delivery (Dark Reading)](https://www.darkreading.com/data-privacy/adfection-online-ads-spyware-delivery)
- [First mercenary spyware delivered via targeted ads uncovered by Citizen Lab (Privacy Guides)](https://www.privacyguides.org/news/2026/10/16/first-mercenary-spyware-delivered-via-targeted-ads-uncovered-by-citizenlab.md)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5640