A growing trend in spyware attacks is casting a wider net, targeting ordinary citizens rather than high-profile individuals or organizations. A recent report from iVerify highlights this shift, analyzing data on customer infections and threat notifications from Apple that reveals the extent of this new approach.
The AdFection spyware attacks are a prime example of this indiscriminate tactic. These attacks can infect anyone who visits a website with online ads, making it a numbers game rather than a targeted operation. The iVerify report points out that conventional wisdom on spyware risk has focused on individuals with public profiles or sensitive jobs, but the data shows that ordinary people are now being caught in the crosshairs.
Take the case of a city bus driver and a stay-at-home mom from Ottawa, who both received Apple Threat Notifications this year. Or a limousine driver from Australia, who was similarly targeted despite having no obvious connection to anyone worth spying on. These cases matter because they demonstrate that the threat is now reaching people who had no reason to expect it.
According to iVerify’s Rocky Cole, the shift in targeting reflects a change in who’s using spyware. “The vast majority of our detections were mass attacks by criminal groups looking to do purely criminal things,” he explains. “For the purposes of stealing credentials and selling them on the black market, an executive credential is not necessarily more valuable than a system administrator or even an average employee.” In other words, these attackers are no longer targeting specific individuals or organizations; instead, they’re going after anyone who will yield to their exploitation.
Another trend highlighted by iVerify’s report is that state-sponsored actors and well-known commercial spyware vendors like NSO Group’s Pegasus are not the primary culprits. In fact, three-quarters of this year’s detections were attributed to criminal adversaries stealing credentials and cryptocurrency. This suggests that nation-state threats and high-end spyware may be less relevant than previously thought.
The report also notes that the rate of spyware infections held relatively steady in 2026, at 1.07 infections per 1,000 iOS consumer scans. While this may seem low, it’s a sobering reminder that anyone can be affected by these attacks, regardless of their public profile or job title.
So what does this mean for ordinary citizens? The takeaway is clear: even if you’re not a high-value target, you’re still at risk. To protect yourself, make sure to practice good cyber hygiene, such as keeping your device and software up to date, using strong passwords, and being cautious when clicking on links or downloading attachments from unknown sources. It’s also essential to be aware of the websites you visit, especially if they have online ads, and consider using a reputable ad blocker or browser extension to minimize your exposure to these types of attacks.
Source: CyberScoop — 2026-11-10