EN PT-BR
← Voltar ao feed
high media general_public

iVerify finds spyware increasingly hits ordinary iOS users, with three in four 2026 detections criminal

1 fonte(s) · 1 atualização(ões) · publicado 10/11/2026 08:00 · coletado há 59 minutos

Spyware targeting is becoming less selective. An iVerify report covered by CyberScoop logged Apple Threat Notifications sent to people with no public profile or sensitive role, including the children of a bus driver in Ottawa and a limousine driver in Australia. The infection rate held at 1.07 infections per 1,000 iOS consumer scans in 2026, and iVerify says three in four detections were criminal groups stealing credentials and cryptocurrency rather than state actors. It saw no Apple notifications tied to the DarkSword or Coruna iOS exploit kits, which it reads as a sign that Apple's notifications lean toward nation-state and commercial mercenary spyware. The trend is reinforced by AdFection, a zero-click technique that Citizen Lab documented on 15 October 2026, in which Israeli ad-tech firm Discover-Tech delivered Candiru spyware through targeted advertising (citizenlab.ca). The criticity is high rather than critical because the article names no CVE and no vendor patch, and its figures are a trend and an industry vendor's own statistics, although the ad-delivered vector can reach a very broad audience.

Detalhes técnicos

  • AdFection is described by Citizen Lab as the first public technical confirmation of a zero-click mercenary spyware attack delivered through targeted advertising. At least 45 devices at Al Jazeera were targeted in these attacks (citizenlab.ca).
  • Discover-Tech's ads ran on almost 200,000 unique websites and Android and iOS apps across dozens of countries over a four-month period, and the ads covertly directed millions of devices to contact Candiru servers (citizenlab.ca). The operation ran through the company's Controlium platform (citizenlab.ca).
  • Candiru is rebranded as Integrity Labs (citizenlab.ca). Confiant co-timed its own investigation with the Citizen Lab report (citizenlab.ca).
  • Citizen Lab stresses that an ad impression alone does not prove a device was infected (campaignlive.com).
  • The delivery is mapped to drive-by compromise through web content (MITRE ATT&CK T1189).

Remediação

  • iVerify reported in March 2026 that part of the Coruna exploit chain was patched with iOS 17.3 (iverify.com), so devices on older iOS releases remain the exposed population, a pattern also noted for DarkSword (cybersecurity-insiders.com).
  • Users who receive an Apple threat notification are advised to verify it by signing in directly at account.apple.com rather than clicking links in the message, and to preserve genuine notifications and suspicious messages (foxnews.com).

Linha do tempo

  1. cyberscoop.com ↗ · pub. 10/11/2026 08:00 · coletado 10/11 09:00 primeiro registro

    iVerify finds spyware increasingly hits ordinary iOS users, with three in four 2026 detections criminal

    ler a análise desta fonte

    Spyware targeting is becoming less selective. An iVerify report covered by CyberScoop logged Apple Threat Notifications sent to people with no public profile or sensitive role, including the children of a bus driver in Ottawa and a limousine driver in Australia. The infection rate held at 1.07 infections per 1,000 iOS consumer scans in 2026, and iVerify says three in four detections were criminal groups stealing credentials and cryptocurrency rather than state actors. It saw no Apple notifications tied to the DarkSword or Coruna iOS exploit kits, which it reads as a sign that Apple's notifications lean toward nation-state and commercial mercenary spyware. The trend is reinforced by AdFection, a zero-click technique that Citizen Lab documented on 15 October 2026, in which Israeli ad-tech firm Discover-Tech delivered Candiru spyware through targeted advertising (citizenlab.ca). The criticity is high rather than critical because the article names no CVE and no vendor patch, and its figures are a trend and an industry vendor's own statistics, although the ad-delivered vector can reach a very broad audience.

    Technical Details

    • AdFection is described by Citizen Lab as the first public technical confirmation of a zero-click mercenary spyware attack delivered through targeted advertising. At least 45 devices at Al Jazeera were targeted in these attacks (citizenlab.ca).
    • Discover-Tech's ads ran on almost 200,000 unique websites and Android and iOS apps across dozens of countries over a four-month period, and the ads covertly directed millions of devices to contact Candiru servers (citizenlab.ca). The operation ran through the company's Controlium platform (citizenlab.ca).
    • Candiru is rebranded as Integrity Labs (citizenlab.ca). Confiant co-timed its own investigation with the Citizen Lab report (citizenlab.ca).
    • Citizen Lab stresses that an ad impression alone does not prove a device was infected (campaignlive.com).
    • The delivery is mapped to drive-by compromise through web content (MITRE ATT&CK T1189).

    Remediation

    • iVerify reported in March 2026 that part of the Coruna exploit chain was patched with iOS 17.3 (iverify.com), so devices on older iOS releases remain the exposed population, a pattern also noted for DarkSword (cybersecurity-insiders.com).
    • Users who receive an Apple threat notification are advised to verify it by signing in directly at account.apple.com rather than clicking links in the message, and to preserve genuine notifications and suspicious messages (foxnews.com).