Criminal kits, not Pegasus, dominate iVerify's consumer spyware detections

The Record, citing iVerify telemetry, reports 1.07 spyware detections per 1,000 free consumer scans, against 0.7 per 1,000 enterprise scans. Rocky Cole said hundreds of thousands of consumer devices were checked but declined an exact count, and put a typical Fortune 500 haul at about 65 infected devices a year, mostly rank-and-file rather than executives. About 75 percent of hits were classed as Coruna or DarkSword, criminal exploit kits delivered via compromised sites and used for credential and crypto theft. About 25 percent were classed as mercenary implants, including Pegasus.

Read the denominator before the slogan. One detection per 900 scans is not one infection per 900 iPhones. The sample is whoever ran a free check from a company that sells detection. iVerify's criminal-versus-mercenary split is its classification, not a joint finding by Google's Threat Intelligence Group, Citizen Lab, or Apple. The Record says GTIG identified Coruna in February 2025 and links circulation to ex-L3Harris Trenchant executive Peter Williams, sentenced to seven years in February 2026. Treat that sentence as reported, not independently re-verified here. A mercenary implant is not technical attribution to a named state.

The underplayed shift is price. State clients bought a scalpel. Criminal operators need a net, because an implant can pay out in wallet keys and logins. That fits ordinary employees better than a story in which intelligence services abandoned VIPs. Patching and network controls can explain the lower enterprise rate without proving offices were deprioritized. iVerify says Apple threat notifications never reached DarkSword or Coruna victims. Apple has long said those notices cover only some mercenary activity and are not a clean bill of health. A channel built for a short vendor list misses leaked kits by design.

Next signal is corroboration, not another awareness campaign. Watch for a GTIG, Citizen Lab, or Apple document that either backs a criminal-kit majority on consumer iOS or rejects 1.07 per 1,000 as non-representative. Watch bank and exchange filings for a crypto-theft cluster, the cash logic behind mass infection. Watch insider-threat fallout at exploit contractors: if the Williams reporting holds, the capability started in a defense supply chain, not on a crime forum. Claims that mercenary spyware stays controlled already conflict with that paper trail.