Cybercriminals are increasingly infecting regular people with spyware
Cybercriminals are increasingly infecting average people with spyware, with exploit kits like Coruna and DarkSword
Cybercriminals are increasingly infecting average people with spyware, with exploit kits like Coruna and DarkSword facilitating widespread credential and crypto theft. A report by iVerify found a higher infection rate in consumer devices compared to enterprises, attributing this to enterprises' stronger security controls. These exploit kits, purloined from sources like defense contractors, enable large-scale attacks through online ads and watering hole techniques, bypassing Apple's threat notifications.
AI summary of the linked source. Not reviewed by an editor. How this works
Run iVerify?
Get an email when a new story names iVerify, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonExploit kits like Coruna and DarkSword — originally stolen from defense contractors — are now being weaponized against everyday consumers through malicious online ads and watering hole attacks, stealing credentials and cryptocurrency. The higher infection rate on consumer devices compared to enterprise devices reveals that personal users lack the layered security controls organizations typically enforce. The theft of these sophisticated tools from supply chain sources amplifies the risk dramatically, as nation-state-grade capabilities fall into criminal hands. This matters because spyware infections on personal devices can compromise both individual finances and, through credential reuse, corporate networks. Average users remain largely unaware of these threats and lack the tools or habits to detect or prevent them.
What helps against this
How we list vendors
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Coruna
- malware — DarkSword
- malware — Pegasus