Updated October 2026: iVerify has published new research on iPhone spyware since this post first ran in June 2025. Its October 2026 reports cover a new DarkSword variant called P7 and a campaign it calls DeadTag, which used thousands of legitimate websites and ads to deliver exploits to iPhones. The latest findings are summarized first below. The original June 2025 report follows.
October 2026: What iVerify’s Latest iPhone Research Found
DeadTag: 6,600 Legitimate Websites Used to Deliver iPhone Spyware
On October 21, 2026, iVerify and Report URI disclosed a campaign they named DeadTag. Attackers took over abandoned advertising and analytics domains that were still referenced by at least 6,600 legitimate websites, so the site owners had no idea their pages were serving malicious code. Together those sites see about 49 million visits a month. Of them, 248 sites, with roughly 8 million monthly visits, delivered iPhone exploits directly. The rest redirected visitors to spam pages.
The case that drew the most attention involved an employee at a financial institution. Their iPhone was compromised after they scrolled past a soccer ad on Instagram. The script behind the ad checked the phone’s iOS version, then served an exploit matched to it, which installed spyware that stole credentials and searched the device for crypto wallets. The user did not tap anything they would have recognized as risky.
The researchers linked the activity to a criminal group with suspected ties to China. Report URI’s Scott Helme cautioned that the attribution is uncertain and the group may simply want to look Chinese.
P7 DarkSword: A New Variant With Crypto Wallet Theft and Remote Commands
On October 8, 2026, iVerify reported a new version of the DarkSword spyware, which it calls P7, found while investigating an August 2026 infection. Compared with earlier DarkSword builds, P7 accepts remote commands from its operators, leaves a smaller footprint on the device, and processes stolen keychain data on the phone itself. It collects photos, copies the Apple Notes database, and looks for installed crypto wallet apps.
P7 is an evolution of a known threat, not proof that the newest iOS protections have been broken. It depends on devices that have not been updated.
Coruna and DarkSword: Which iPhones Are Affected
DeadTag traffic fed two iOS exploit kits. iVerify has also seen them served together from a single site, a pairing it calls DarkCoruna.
| Exploit Kit | Targeted iOS Versions | Details |
| Coruna | iOS 13.0 to 17.2.1 | 23 exploits across five chains, per Google Threat Intelligence Group. Ineffective against current iOS. |
| DarkSword | iOS 18.4 to 18.7 | Chains six vulnerabilities. Source code leaked publicly in March 2026, which led to new variants such as P7. |
Apple has patched the vulnerabilities both kits rely on, including fixes backported to older devices in iOS 16.7.15 and iOS 15.8.7. The risk is the large number of iPhones that never got those updates. Researchers estimate that 220 to 270 million iPhones may still run vulnerable iOS versions, and Lookout puts roughly 15% of active iOS devices on iOS 18 or earlier.
How to Reduce the Risk
- Update iOS. Installing the latest release closes the flaws Coruna and DarkSword use. iVerify and Apple both name this as the first step.
- Turn on Lockdown Mode for high-risk users. It limits the web and messaging features these exploit chains depend on.
- Audit third-party scripts on your own websites. DeadTag worked because sites kept loading code from expired ad and analytics domains. Remove unused tags and monitor what your pages load.
- Know which phones are inside sensitive spaces. A compromised iPhone can capture audio, photos, and credentials wherever it goes. In secure facilities, organizations need visibility into the cellular, Wi-Fi, and Bluetooth devices actually present, not just the ones they issued.
Possible Spyware Attack on High-Profile iPhone Users Underscores Growing Mobile Device Risk
A new report from mobile-forensics specialist iVerify claims that the iPhones of at least five prominent Americans, including former staffers on the 2024 Harris-Walz presidential ticket, show digital fingerprints consistent with a sophisticated “zero-click” spyware campaign. Apple disputes the conclusion, insisting the artifacts relate to “a conventional software bug that we identified and fixed in iOS 18.3.”
While attribution remains uncertain, the discovery once again spotlights how nation-state adversaries are weaponising the wireless layer
“We’re not waving a smoking gun, but the clustering of rare crash-log patterns on high-value targets is significant and should be shared with the research community,”
Rocky Cole, CEO, iVerify
iVerify’s Claims about the Possible Hack:
Out of nearly 50,000 iPhones analyzed by the researchers, only six, all linked to politics, AI, or national media, showed the anomalous crash logs.
iVerify believes that threat actors pushed the spyware last year without user interaction
An undisclosed iMessage flaw is iVerify’s prime suspect. Apple patched this flaw in its iOS 18.3 update.
This update also patched a critical vulnerability in Apple’s Bluetooth implementation that would allow attackers to gain control over the Bluetooth antenna of the device:
CVE-2024-9956: Passkeys
Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later
Impact: An app may gain unauthorized access to Bluetooth
Description: This is a vulnerability in open source code, and Apple Software is among the affected projects.”
Surge of Targeted Mobile Device Attacks
As we highlighted in our recent blog post, Wormable Zero-Click Wireless Vulnerabilities Threaten Apple Ecosystem and 3rd-Party IoT Devices, Apple has faced a sudden surge of ‘in-the-wild’ targeted zero-day attacks against its users in 2025.
2025 Zero-Day Trendline: Apple’s Wireless Blind Spots Keep Widening
| Date (2025) | CVE | Sub-System | Exploit Confirmed in the Wild | Affected Platforms |
| Jan 28 | CVE-2025-24085 | CoreMedia | ✅ | iOS / iPadOS / macOS / tvOS / visionOS / watchOS |
| Feb 10 | CVE-2025-24200 | USB Restricted Mode | ✅ | iOS / iPadOS |
| Mar 11 | CVE-2025-24201 | WebKit | ✅ | iOS / iPadOS / Safari |
| Apr 16 | CVE-2025-31200 | CoreAudio | ✅ | iOS / iPadOS / macOS |
| Apr 16 | CVE-2025-31201 | RPAC (Pointer Auth) | ✅ | iOS / iPadOS / macOS |
Targeted Attacks Go Nationwide:
The recent trend in targeted mobile device attacks extends beyond the physical devices themselves, however.
In late 2024, investigators uncovered “Salt Typhoon,” a Chinese-linked group that infiltrated at least nine American telecom carriers, including AT&T, Verizon, Lumen, and several regional backbones, targeting prominent U.S. politicians, including members of the Harris-Walz and Trump-Vance 2024 presidential campaigns. Due to the extent of the attackers’ infiltration of US telecom infrastructure, the FBI issued warnings advising all Americans not to use unencrypted mobile messaging applications or unencrypted voice communication platforms, given Salt Typhoon’s potential access to them.
Patrick Arvidson, a former NSA mobile-security lead who previewed iVerify’s report, warns the trend line for these attacks is headed up and to the right:
“I think that you’re going to see in the coming year, two years, three years, more and more of these kinds of mass-scale incidents.”
Speaking to reporters, Cole himself warned that more of these attacks are likely to come:
“I think it illustrates that mobile compromise is real, not academic or hypothetical, and it’s happening here in the United States in a systematic way.”