[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fK-mkBIY5aWBlN0aXk1ztpt52BsUkbQ2cxiHVDZ1Y8KM":3},{"article":4,"iocs":52,"watch_terms":59,"solutions":60,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"4ca58b6a-b66d-48b2-a145-5f545cb31d47","Cybercriminals are increasingly infecting regular people with spyware","cybercriminals-are-increasingly-infecting-regular-people-with-spyware-ac3b2b","Cybercriminals are infecting devices on a large scale with spyware, increasingly compromising systems belonging to average people, according to a new report.","Cybercriminals are increasingly infecting average people with spyware, with exploit kits like Coruna and DarkSword facilitating widespread credential and crypto theft. A report by iVerify found a higher infection rate in consumer devices compared to enterprises, attributing this to enterprises' stronger security controls. These exploit kits, purloined from sources like defense contractors, enable large-scale attacks through online ads and watering hole techniques, bypassing Apple's threat notifications.","Cybercriminals are increasingly infecting average people with spyware, with exploit kits like Coruna and DarkSword","https:\u002F\u002Ftherecord.media\u002Fspyware-cyber-crime-iverify","http:\u002F\u002Fcms.therecord.media\u002Fuploads\u002Fiphone_8675e4e6f4.jpg","2026-11-10T15:45:00+00:00","2026-11-10T16:00:08.218911+00:00",8,[17,20,23,25,27],{"name":18,"type":19},"iVerify","vendor",{"name":21,"type":22},"Coruna","product",{"name":24,"type":22},"DarkSword",{"name":26,"type":22},"Pegasus",{"name":28,"type":19},"L3Harris","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":29,"icon":31,"name":32,"slug":33},null,"Malware","malware",[35,40,45,47],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":41},{"id":42,"icon":31,"name":43,"slug":44},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":46},{"id":29,"icon":31,"name":32,"slug":33},{"category":48},{"id":49,"icon":31,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53,55,57],{"type":33,"value":21,"context":54},"Exploit kit and spyware framework used by cybercriminals.",{"type":33,"value":24,"context":56},"Advanced, full-chain JavaScript-based iOS exploit kit and spyware framework.",{"type":33,"value":26,"context":58},"Mercenary spyware mentioned as a comparison for capabilities.",[18,28,21],{"controls":61,"vendors":145},[62,90,116],{"slug":63,"name":64,"problem":65,"products":66},"patch-management","Automated patch management","Known holes get closed in days, not months.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":63,"product_name":87,"url":88,"description":89},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":91,"name":92,"problem":93,"products":94},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[95,100,108],{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":96,"product_name":97,"url":98,"description":99},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":117,"name":118,"problem":119,"products":120},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"quad9","Quad9","\u002Fvendor-logos\u002Fquad9.png","quad9-dns","Quad9 DNS","https:\u002F\u002Fwww.quad9.net\u002F","Free, privacy-focused DNS resolver that blocks malicious domains using threat intelligence feeds.",[146],{"slug":147,"name":148,"logo_path":149,"roles":150},"apple","Apple","\u002Fvendor-logos\u002Fapple.png",[151],"affected",{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":162},"consumer-spyware-surge-highlights-gap-between-enterprise-and-personal-security","Consumer Spyware Surge Highlights Gap Between Enterprise and Personal Security","Exploit kits like Coruna and DarkSword — originally stolen from defense contractors — are now being weaponized against everyday consumers through malicious online ads and watering hole attacks, stealing credentials and cryptocurrency. The higher infection rate on consumer devices compared to enterprise devices reveals that personal users lack the layered security controls organizations typically enforce. The theft of these sophisticated tools from supply chain sources amplifies the risk dramatically, as nation-state-grade capabilities fall into criminal hands. This matters because spyware infections on personal devices can compromise both individual finances and, through credential reuse, corporate networks. Average users remain largely unaware of these threats and lack the tools or habits to detect or prevent them.",[157,158,159,160,161],"CIS Control 2: Inventory and Control of Software Assets (v8)","CIS Control 7: Continuous Vulnerability Management (v8)","NIS2 Article 21(2)(g)","MITRE ATT&CK T1189: Drive-by Compromise","NIS2 Article 21(2)(d)",{"NIS2 Article 21(2)(d)":163,"NIS2 Article 21(2)(g)":164,"MITRE ATT&CK T1189: Drive-by Compromise":165,"CIS Control 7: Continuous Vulnerability Management (v8)":166,"CIS Control 2: Inventory and Control of Software Assets (v8)":167},"The theft of exploit tools from defense contractors represents a supply chain security failure that enabled these criminal campaigns at scale.","Basic cyber hygiene and user training would equip everyday users to recognize and avoid malvertising and watering hole attacks used to distribute spyware.","Watering hole and malvertising techniques used by these exploit kits to silently infect consumer devices are a direct instance of this ATT&CK technique.","Regularly patching and updating devices would close the vulnerabilities that exploit kits like Coruna and DarkSword leverage to install spyware.","Tracking and controlling what software runs on devices would help detect unauthorized or malicious spyware installations on consumer and enterprise endpoints."]