Criminal Campaigns Drove 75% of Spyware Detections, Study Finds

Criminal campaigns accounted for 75% of spyware detections in a study published Nov. 10, underscoring the operational risk that commercial exploit kits pose to cryptocurrency holders using vulnerable iPhones.

The study examined detections tied to two exploit kits, Coruna and DarkSword. Both have been deployed in campaigns that reach targets through online ads, watering-hole websites and phishing lures. Once a vulnerable phone is compromised, the kits can collect stored passwords, messages, photos and cryptocurrency-related information.

How widespread are the infections?

The monitored-device estimate came in at 1.07 iOS infections per 1,000 consumer devices as of October 2026. That figure is a conservative lower-end estimate, and it applies only to the devices under monitoring in the study. It is not a prevalence measure for all iPhones, and treating it as one would overstate the observed infection base.

The 75% share for criminal campaigns means the remainder of detections in the study stemmed from other categories of actors. The findings add to earlier reporting on the DarkSword iPhone threat.

For crypto users, the exposure is specific: the kits target exactly the data that secures funds and accounts. Stored passwords, wallet-related credentials and recovery material kept in Photos or Notes all fall within what the kits can collect on a compromised device.

Rocky Cole, co-founder and COO of iVerify, quantified the tempo of the attacks: "We are confirming attacks every week."

Did Apple and Google patch these campaigns?

Not demonstrably. Apple and Google issued security advisories on Nov. 9, but neither advisory linked its updates to the Coruna or DarkSword campaigns. The advisories therefore do not establish that either update addressed those campaigns.

That gap matters for defenders. Users cannot assume that a routine update has closed the specific delivery paths these kits use, particularly on older devices that no longer receive current iOS versions.

What did Trust Wallet recommend?

Trust Wallet issued guidance on Nov. 6 with three concrete steps for iPhone users:

• Install the latest iOS version supported by their devices.
• Enable Lockdown Mode if unable to update.
• Keep recovery phrases out of Photos and Notes.

The third recommendation responds directly to the kits' documented collection capability. A recovery phrase stored in Photos or Notes on a compromised device is retrievable by the attacker, converting a spyware infection into a direct loss of funds rather than a privacy incident.

The Lockdown Mode advice covers the population most exposed: users on hardware too old to run patched iOS builds. For that group, restricting attack surface at the operating-system level is the remaining mitigation short of replacing the device.

What happens next?

Weekly-confirmed attacks and an unattributed patch status suggest the campaign window remains open. Users holding crypto on affected devices should verify their iOS version against Apple's Nov. 9 advisory and move recovery material off the phone before the next confirmed wave of detections.