[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fMAZoLJ8n5GOBdCeBGQzm4OOviSncbCIDN3QNkELd4rg":3},{"article":4,"iocs":45,"watch_terms":54,"solutions":55,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"38853cf8-1968-4b84-be84-3eb1dcf58634","Spyware attacks trend toward hitting just about anyone","spyware-attacks-trend-toward-hitting-just-about-anyone-b463d2","iVerify’s report Tuesday adds to evidence of spyware’s increasingly indiscriminate targeting. The post Spyware attacks trend toward hitting just about anyone appeared first on CyberScoop.","A new report from iVerify indicates a growing trend of spyware attacks becoming more indiscriminate, moving beyond traditional high-value targets like executives or government officials. The analysis of Apple threat notifications reveals infections affecting everyday individuals such as a bus driver's children and a limousine driver, suggesting criminal groups are using spyware for mass credential and cryptocurrency theft rather than solely for state-sponsored espionage.","Spyware attacks are increasingly targeting ordinary citizens, not just high-profile individuals.","https:\u002F\u002Fcyberscoop.com\u002Fspyware-attacks-trend-everyday-people-iverify-report\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F11\u002FGettyImages-2116322861.jpg","2026-11-10T11:00:00+00:00","2026-11-10T12:00:31.622917+00:00",7,[17,20,22,24],{"name":18,"type":19},"Apple","vendor",{"name":21,"type":19},"iVerify",{"name":23,"type":19},"NSO Group",{"name":25,"type":26},"Pegasus","product","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":27,"icon":29,"name":30,"slug":31},null,"Threat Intelligence","threat-intelligence",[33,38,43],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":44},{"id":27,"icon":29,"name":30,"slug":31},[46,49,52],{"type":42,"value":47,"context":48},"AdFection","Spyware attack mentioned as an example of indiscriminate targeting.",{"type":42,"value":50,"context":51},"DarkSword","iOS exploit kit where users did not receive Apple threat notifications.",{"type":42,"value":53,"context":51},"Coruna",[18,21,23],{"controls":56,"vendors":139},[57,86,112],{"slug":58,"name":59,"problem":60,"products":61},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":87,"name":88,"problem":89,"products":90},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[91,99,104],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":100,"product_name":101,"url":102,"description":103},"falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":113,"name":114,"problem":115,"products":116},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[117,125,132],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":126,"product_name":129,"url":130,"description":131},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":113,"product_name":136,"url":137,"description":138},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[140],{"slug":141,"name":18,"logo_path":142,"roles":143},"apple","\u002Fvendor-logos\u002Fapple.png",[144],"affected",{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":157},"spyware-goes-mainstream-everyday-users-now-prime-targets","Spyware Goes Mainstream: Everyday Users Now Prime Targets","Spyware attacks, once reserved for high-value political or corporate targets, are now being deployed indiscriminately against ordinary individuals for financial gain — including credential theft and cryptocurrency fraud. Criminal groups have recognized that mass deployment of spyware against everyday users can yield significant returns without the scrutiny that high-profile attacks attract. This shift means the average person's device is now a viable target, yet most individuals lack the awareness or tools to detect a compromise. The consequences extend beyond privacy violations to direct financial loss, making this a critical security awareness and data protection challenge for the general public.",[150,151,152,153,154,155,156],"CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","GDPR Article 32","MITRE ATT&CK T1566: Phishing",{"GDPR Article 32":158,"MITRE ATT&CK T1566: Phishing":159,"NIST SP 800-53 SI-2: Flaw Remediation":160,"CIS Control 17: Incident Response Management":161,"CIS Control 14: Security Awareness and Skills Training":162,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":163,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":164},"Where spyware harvests personal data from individuals' devices, controllers and processors have an obligation under Article 32 to implement appropriate technical measures — such as encryption and access controls — to protect that data against unauthorized processing.","Spyware campaigns commonly use phishing as an initial delivery mechanism; understanding and defending against this technique is directly relevant to preventing the infections described in the report.","Spyware typically exploits unpatched OS or application vulnerabilities on mobile devices; timely flaw remediation through patching would close the attack surface used in these campaigns.","Victims of spyware infections need a clear, practiced incident response process to contain credential theft and cryptocurrency fraud quickly once a compromise is suspected or confirmed.","Everyday users targeted by indiscriminate spyware campaigns lack the knowledge to recognize infection vectors; structured awareness training would help them identify phishing lures and risky behaviors that enable spyware delivery.","Organizations are required to identify and remediate technical vulnerabilities in a timely manner, which directly applies to the unpatched mobile device flaws exploited to deliver spyware to unsuspecting users.","Stolen credentials harvested by spyware can be mitigated through strong multi-factor authentication and privileged access controls, limiting the blast radius of a successful infection."]