Cybercriminals are infecting devices on a large scale with spyware, increasingly compromising systems belonging to average people, according to a new report.
There’s mounting evidence of spyware attacks growing more indiscriminate, leading to more everyday citizens being hit as opposed to traditionally “high-value” targets.
The AdFection spyware attacks, which could infect anyone visiting a website that had advertising on it, represented the most recent revelation. And iVerify published a report Tuesday analyzing customer infections and threat notifications from Apple that contributes to the trend.
“Conventional guidance on spyware risk focused on people with a public profile, a sensitive job or a role that put them on a government’s radar,” the company said. “Some Apple Threat Notification cases iVerify saw this year don’t fit that pattern.”
“In Ottawa, Apple Threat Notifications reached the children of a city bus driver and a stay-at-home mom,” it continued. “In Australia, one went to a limousine driver. None of them had a public profile, a sensitive job or an obvious connection to anyone worth spying on. These cases matter because they show the threat reaching people who had no reason to expect it. For an enterprise, the employees most likely to be hit look much more like the limousine driver than like the CEO.”
Part of that is that when spyware attacks are less targeted, they might be more likely to hit those who aren’t as diligently focused on routine cyber hygiene, as opposed to CEOs who are probably regularly upgrading their defenses, iVerify told CyberScoop.
Rocky Cole, co-founder of the company, said the change reflects a shift in who’s using spyware.
“The vast majority of our detections were mass attacks by criminal groups looking to do purely criminal things,” Cole said. “For the purposes of stealing credentials and selling them on the black market, an executive credential is not necessarily more valuable than a system administrator or even an average employee.”
iVerify’s report looked at other trends as well. Among the findings:
iVerify didn’t see any devices that were infected by the DarkSword or Coruna iOS exploit kits where users received Apple threat notifications, suggesting that the tech giant might be overly focused on nation-state threats and well-known commercial mercenary spyware like NSO Group’s Pegasus.
The rate of spyware infections held relatively steady in 2026, at 1.07 infections per 1,000 iOS consumer scans.
“Three in four of this year’s detections were criminal adversaries stealing credentials and cryptocurrency, not state-sponsored actors,” the report said.
The U.S arm of international hearing aid company Amplifon has been notifying customers about a data breach early this year that included medical information.
In the first attribution since the October attacks, the French authorities identified the perpetrators as part of Shahid Kaveh, an IRGC cyber unit previously linked to attacks on industrial controllers at U.S. water utilities.
Hackers allegedly assisted by AI breached a German web hosting company through a tool designed to allow customers to connect AI assistants to their accounts, the company disclosed.
Three men concocted an elaborate, yearslong scheme that defrauded companies of at least $129 million by using AI to impersonate executives and lawyers, tricking targeted victims into transferring large payments to criminal-controlled accounts, the Justice Department said Thursday.
Jacob Soall, Sharon Hazan and Guy Sheetrit allegedly used AI to impersonate the voices and images of chief executive officers at companies and lawyers at major international law firms. The trio are accused of targeting thousands of victims between July 2024 and February 2026, according to court records.
Victims include a U.K.-based financial tech company that lost almost $11.6 million, a Florida-based pet food company that lost $5.2 million, a Missouri-based hospital system that lost $4.8 million, a Massachusetts-based mutual fund company that lost $4.6 million, a California-based hospital system that lost nearly $3 million, a New York-based investment company duped out of $2.8 million, and a Rhode Island-based bank that transferred nearly $2.7 million.
The trio’s scheme typically started by targeting accounting staff, pretending to be the CEO, and requesting help on a financial transaction, officials said. Using AI to create deepfakes pretending to be CEOs, the crew allegedly directed employees to contact attorneys who they would also impersonate to trick the employee into thinking the financial transaction was legitimate.
Prosecutors said the men and their co-conspirators identified and targeted employees who had sufficient authority to authorize large wire transfers.
The scheme typically began with an email from an e-signature company, wherein the impersonated CEO claimed they were working on a “confidential financial transaction” that required the victim employee to sign a non-disclosure agreement before contacting the purported attorney at a victim law firm, according to an unsealed indictment.
Soall, Hazan, Sheetrit and their co-conspirators allegedly impersonated attorneys at some of the 50 largest law firms globally.
“Super intelligence technology offers tremendous potential, but the public should recognize that there are some who seek to use this emerging technology to pursue criminal goals,” Jamie McDonald, U.S. attorney for the Southern District of New York, said in a statement.
Prosecutors said the wire transfers were sent to bank accounts controlled by co-conspirators around the world, including the United States, Spain, Portugal, Greece, the United Arab Emirates, Singapore, Austria, Slovakia and China. The crew allegedly converted the funds to cryptocurrency and distributed the illicit proceeds amongst themselves and their co-conspirators.
Soall, a 41-year-old from Marbella, Spain, was arrested in Spain on June 17. He allegedly primarily impersonated attorneys from the United Kingdom, reading from a handwritten script designed to dupe targeted victims.
Hazan, a 54-year-old from Israel, was arrested in Spain on Aug. 5. He allegedly boasted that he had been laundering money since 1994, including more than $400 million in the past three years, and was previously convicted in the Southern District of New York of conspiracy to commit bank fraud in 2008.
Sheetrit, a 42-year-old from Israel and the United Arab Emirates, was arrested in the United Kingdom on Sept. 7 and allegedly laundered funds from the scheme.
The trio are charged with conspiracy to commit wire fraud, wire fraud, two counts of aggravated identity theft, money laundering conspiracy and two counts of money laundering. The seven counts carry a maximum sentence of 104 years in prison.
“The alleged scheme orchestrated by Soall, Hazan, and Sheetrit demonstrates how the use of advanced technology can be exploited to commit large scale fraud,” James C. Barnacle Jr., assistant director in charge of the FBI New York field office, said in a statement.
“As criminals continue to weaponize emerging technologies, the FBI remains committed to rapidly adapting our capabilities to identify, investigate, and disrupt those who seek to harm New Yorkers and businesses operating in our communities.”
After initial publication of this story, Sheetrit’s attorneys, Sharon Nahari and Shay Shorer, emailed a statement to CyberScoop saying their client “has no connection to this matter and has had no involvement in it whatsoever.”
“Mr. Sheetrit is a businessman with extensive expertise and professional experience in cybersecurity and technology,” wrote Nahari and Shorer. “In the course of his work, he provides professional advisory services to a range of clients. Working in cybersecurity, possessing specialist expertise or providing advisory services cannot, in themselves, establish complicity in or involvement in the alleged conduct.”
“Our client maintains his complete innocence and, like everyone else, is entitled to the presumption of innocence,” the statement continued. “We are confident that, once the facts have been established and the evidence fully examined, it will become clear that there is no basis for holding him criminally responsible.”
UPDATE: Nov. 6, 2026; 8:25 p.m.: This story has been updated to include a statement from attorneys representing Guy Sheetrit.
The case, brought by AGs in Connecticut, New Jersey, New York and Michigan, targeted the medical transcription, coding and imaging subsidiaries of the Nevada-based Perry Johnson Companies.
DigiCert explained that over the summer, an internal business system was "externally accessible when that was not intended," and someone had created an unauthorized account.
Patrick Steven Yaroch, 37, is facing up to 20 years in prison on wire fraud and money laundering charges after admitting to using his position on an FBI investigative squad to steal more than $2.4 million in cryptocurrency to cover his debts.
The library system, which has 66 branches serving the borough’s 2.3 million residents, published multiple alerts on Wednesday confirming that the disruption was caused by a ransomware attack.
Two Canadian men broke into the networks of multiple U.S. universities, stole credentials and implanted malware on compromised computers to commandeer processing power for a cryptocurrency mining operation, the Justice Department said.
Ryan James Roach and Mathiew James Stubbings allegedly compromised the networks of at least four universities in New York, Tennessee, North Carolina and Massachusetts between mid 2016 and late 2019, according to an unsealed indictment.
Roach, a 35-year-old from Saskatchewan, Canada, was extradited to the United States on Oct. 28 and arraigned Tuesday in the U.S. District Court for the Western District of New York. Prosecutors said they are still seeking the extradition of Stubbings, a 41-year-old from Ontario, Canada.
A grand jury previously indicted the Canadian nationals in April 2022. The men are charged with multiple cybercrimes and face up to 10 years in prison and up to a $250,000 fine, if convicted.
Prosecutors accuse the men of researching and identifying potential victims with supercomputers containing vulnerabilities they could exploit. The men breached networks and deployed malware on compromised machines to take over systems, officials said.
Roach and Stubbings allegedly rented virtual private servers based in Europe and the United States under false identities to conceal traffic, deploy rootkits, steal credentials and data, and transmit cryptocurrency mining software to compromised computers.
“The defendants caused at least one supercomputer to mine cryptocurrency on their behalf, which caused much of the supercomputer’s processing speed and power to become unavailable to its legitimate owner,” prosecutors wrote in the indictment.
Officials didn’t say how much cryptocurrency the pair allegedly mined for financial gain as part of the conspiracy.
If convicted, Roach and Stubbings are also ordered to forfeit an assortment of networking and data storage devices, and any property or proceeds obtained through the alleged crime spree.
Japan Airlines, Cathay Pacific, Korean Air, Asiana Airlines, Singapore Airlines and Malaysia Airlines have all come forward over the last week to report data breaches traced back to Amadeus IT Group — a company that builds and maintains platforms for flight reservation, ticketing and check-in platforms.
The Department of Justice said it identified two suspects in a case that dates back to 2016 and involved illicit cryptomining on the computers of U.S. educational institutions.
Crédit Mutuel Arkéa said in a press notice that the attackers were able to make transfers using the bank’s own account after compromising an unnamed supplier.
Login
