iVerify Report Points to Workforce-Wide Mobile Spyware Risk

iVerify’s 2026 report, as reported by CyberScoop, adds evidence that spyware risk is extending beyond executives and other traditionally high-profile targets. The company analyzed customer infection data and Apple threat notifications, finding cases involving people without public profiles, sensitive jobs, or an apparent connection to a person of interest. Examples cited include Apple notifications reaching the children of a city bus driver and a stay-at-home mother in Ottawa, as well as a limousine driver in Australia. The report’s central implication for government contractors is that mobile threats may affect employees across an organization, not only senior leaders or personnel with obvious intelligence value.

The threat profile described by iVerify also has direct implications for how contractors assess account exposure. Co-founder Rocky Cole said, “For the purposes of stealing credentials and selling them on the black market, an executive credential is not necessarily more valuable than a system administrator or even an average employee.” Criminal groups seeking credentials may therefore target accounts that support routine operations or have access to internal systems, even when their owners are not executives. For procurement and security teams, this reinforces the need to consider mobile security and cyber hygiene across the full workforce, including staff whose roles may not traditionally be treated as high risk.

The report states that spyware infection rates held relatively steady in 2026, at 1.07 infections per 1,000 iOS consumer scans. At the same time, the character of detections is significant: three in four were attributed to criminal adversaries stealing credentials and cryptocurrency rather than state-sponsored actors. iVerify told CyberScoop that less-targeted attacks may be more likely to reach users who are less diligent about routine cyber hygiene, while executives may be more accustomed to regularly upgrading defenses. This suggests that workforce-wide practices and device protections can be relevant to operational resilience, not just executive security.

For contractors, this is a planning signal rather than a buying signal. The source does not identify a solicitation, award, purchasing program, compliance mandate, implementation deadline, or funding amount. Organizations can use the findings to review mobile-device protections, employee awareness, credential safeguards, and incident-response assumptions, and to discuss workforce mobile risk with government customers where appropriate. The report also notes a possible gap in threat-notification coverage: iVerify said it did not see infected devices associated with the DarkSword or Coruna iOS exploit kits among users who received Apple threat notifications. The company suggested Apple may be overly focused on nation-state threats and well-known commercial mercenary spyware such as NSO Group’s Pegasus; this is iVerify’s observation and interpretation, not evidence of a government procurement action.

• iVerify analyzed customer infections and Apple threat notifications in its 2026 report, as covered by CyberScoop.
• The reported iOS consumer scan infection rate was 1.07 per 1,000 scans in 2026 and held relatively steady.
• Three in four detections were attributed to criminal adversaries stealing credentials and cryptocurrency, rather than state-sponsored actors.
• Examples of Apple Threat Notification recipients included the children of a city bus driver and a stay-at-home mother in Ottawa, and a limousine driver in Australia.
• iVerify’s Rocky Cole said system administrators’ and average employees’ credentials can be as valuable to criminals as executive credentials.
• The report reinforces workforce-wide mobile security planning, including protections for employees outside executive and other traditionally high-profile roles.
• iVerify reported seeing no devices infected by the DarkSword or Coruna iOS exploit kits where users received Apple threat notifications.
• iVerify suggested Apple’s notifications may emphasize nation-state threats and known commercial spyware such as NSO Group’s Pegasus; this is the company’s assessment.
• Procurement teams may use the findings to inform internal security planning and customer discussions, but no specific mandate, deadline, solicitation, or purchasing program is identified.