Spyware once built for governments now rides ordinary ads and forgotten website code. If your iPhone is out of date, opening the wrong page is enough.
This week, two security firms published joint research showing that criminal groups are delivering two of the most capable iPhone exploit kits ever found, Coruna and DarkSword, through the ordinary advertising system. One route is a hijacked Instagram ad. The other is old analytics and ad code still sitting on thousands of legitimate websites. The kits steal saved passwords and target crypto wallets, and on a vulnerable phone you do not have to tap anything (iVerify; Report URI).
The good news is plain: A fully updated iPhone is protected. The bad news is that millions of phones are not fully updated.
Jump To Section:
- What Is Happening
- How The Attack Works
- How It Shows Up In Your Day
- Summary
- What You Should Do Now
- Long-Term Habits
Patching your phone closes this hole. Membership keeps you ahead of the next one, with daily briefings, weekly summaries and the protection tools in The Arsenal.
What Is Happening
On 21 October, the mobile security firm iVerify reported that a World Cup-themed Instagram ad infected an employee’s iPhone at one of its customer organizations while that person was simply scrolling the feed. The same person was hit again later through a malicious link from a separate group. Because the company’s security team saw the alerts quickly, it changed the stolen credentials before they could be used (iVerify).
On 22 October, Scott Helme (founder of the web security service Report URI) published the second half of the picture, an operation he calls “DeadTag.” Its operator buys up expired web domains that once hosted analytics and advertising code. So far the researchers have found more than 660 such domains, still loaded by thousands of websites with an estimated 135 million visits a month (Report URI). iVerify says the sites include well-known brands and lean toward European domains rather than .com.
Which phones are at risk:
- Coruna attacks iOS 13 to 17.2.1.
- DarkSword attacks iOS 18.4 to 18.7.
Both kits use security holes Apple has already fixed in newer models. Google’s Threat Intelligence Group (GTIG) says every bug in the DarkSword chain was patched by iOS 26.3 (Google Cloud). Apple’s own guidance says devices on the latest updates of iOS 15 through iOS 26 are protected, and phones still on iOS 13 or 14 must move to iOS 15 (Apple).
How The Attack Works
Almost every website loads small pieces of code from other companies: Analytics, ad networks, chat widgets. Each one is a single line called a “tag.” When the company behind a tag shuts down, the line usually stays in the website because nothing visibly breaks. Eventually its domain expires and goes back on sale. Whoever buys it now controls code that runs on every site still carrying that old tag, without hacking the sites at all.
Report URI describes what the hijacked script does, in three steps:
- It screens the visitor. Search engines, security scanners and automated browsers get nothing, which is why this stayed hidden.
- It asks the attackers’ server what to do with this particular visitor.
- It sends chosen visitors onward, apparently to whichever buyer pays most: fake VPN pop-ups, fake prize pages, gambling and crypto-casino scams, or, for some iPhone users, an exploit page.
The worst buyer, which the researchers call the “iPhone exploit crew,” runs a fake Polymarket (a prediction-market site) page that checks your iOS version and fires the matching kit. Helme writes: “Simply opening the page is enough for your device to be compromised.” The same crew also planted its DarkSword loader on hundreds of online shops running the PrestaShop platform, hidden in a folder named to look like analytics code.
What the spyware steals:
- Passwords and secrets from the iPhone’s keychain (the built-in password store).
- Crypto wallet apps, including Binance, Coinbase Wallet, OKX, Bitget, Trust Wallet, Exodus, TronLink and Bitpie.
- Device and account information. iVerify adds that both kits can pull location data, messages and contacts.
Code comments in Chinese and the choice of wallets point to a Chinese-speaking, profit-driven crew, though the researchers stress this is not proof. Helme’s line: “They’re either Chinese, or they really want us to think that they’re Chinese.”
Status now: The delivery network is live. iVerify found placeholders for future iOS 26 and 27 kits, but says attempts so far are “mostly non-functioning.”
What it means for you: There is no known working attack on a fully updated iPhone today. That can change, which is why updating promptly has to be the whole game for you.
What about Android and computers? These two kits are built for iPhones and iPads running Apple’s browser engine. Researchers found no Android or desktop version.
IMPORTANT: The same hijacked tags send everyone else to scam pages, so the fake pop-ups below matter on every device. And just because no “outdated Android exploit” has been found yet, doesn’t mean that none exist.
How It Shows Up In Your Day
This is what makes it different. You do not have to visit a shady site.
- News and shopping sites you trust. The risk sits in old code the site owner forgot about, not in the site’s own content.
- Social media feeds. iVerify caught one infection from an ad inside the Instagram app and suspects any ad-supported platform may carry similar risk.
- Sudden redirects. A page you opened jumps to another site, a “you’ve won” page, a survey, or a casino sign-up.
- Fake pop-ups. A message that “this video isn’t available in your country” pushing you to install a VPN is one of the lures researchers documented.
- Crypto and betting pages. Fake prediction-market and exchange pages are the crew’s favorite bait.
Possible warning signs of a compromise (none of them is proof on its own):
- Unexpected login alerts or password-reset emails from your accounts.
- Crypto transactions you did not make, or a wallet balance that dropped.
- Unusual battery drain, heat or data use after browsing.
The hard truth: A successful infection usually shows nothing on screen. The real test is your iOS version.
Summary
Tools that used to be reserved for governments and spies are now being rented to ordinary criminals and spread through the same ad pipes that show you shoe ads. The attack needs no click and no mistake from you, only an out-of-date phone. The defense is equally simple and almost entirely in your hands.
What You Should Do Now
Today, in this order:
- Check and update iOS. Go to Settings, General, Software Update, install everything offered, and turn on Automatic Updates. On iOS 18, make sure you are on at least 18.7.7, which Apple pushed specifically against DarkSword (Apple). On older phones, install the latest iOS 15 or 16 update.
- Restart the phone. Report URI notes a reboot may stop an active implant. It will not undo anything already stolen.
- If your phone cannot update, turn on Lockdown Mode (Settings, Privacy & Security, Lockdown Mode). Apple says it blocks these specific attacks even on old software. It makes some sites and features clumsier, and it is a stopgap, not a fix.
- If you hold meaningful crypto on your phone, consider Lockdown Mode even when updated. Both research teams recommend it for likely targets.
- Keep Safari’s protections on. Under Settings, Apps, Safari, keep Fraudulent Website Warning switched on. Apple says Safe Browsing blocks the known malicious domains.
- Add a content blocker. Install a reputable ad and tracker blocker from the App Store and enable it under Safari’s Extensions. Fewer ads and third-party scripts means fewer doors.
If your phone was out of date in recent months, assume exposure and clean up:
- Update first, then change the passwords stored in your keychain, starting with email, banking and any crypto exchange.
- Move your crypto to a new wallet with a new recovery phrase, as both research teams advise. Do it from an updated device. For savings, use a hardware wallet that keeps keys off the phone.
- Switch two-factor codes away from text messages to an authenticator app or passkeys, and sign out of other sessions in each important account.
- Check your accounts for logins, devices and withdrawals you do not recognize, and alert your bank or exchange at once if you find any.
- If you need evidence, iVerify suggests scanning with its free iVerify Basic app before restarting, so logs are preserved.
If you run a website: Audit every third-party tag, remove any for services you no longer use, and set a Content Security Policy (CSP, a rule listing which outside domains your pages may load code from).
Long-Term Habits
- Update within hours or days, not months. Every kit in this story used holes that were already patched on updated systems.
- Retire phones (Androids too) that no longer get updates from banking, email and wallets.
- Separate money from browsing. A dedicated, updated device or a hardware wallet for crypto; your everyday phone for news and social media.
- Use a password manager and passkeys, with a unique password for every account.
- Treat every pop-up that wants an install as hostile, on any device.
- Restart your phone regularly. It is free and can interrupt implants that live only in memory.
A word to the wise, is all…
This Rapid Signal is educational analysis for readers of BackToFreedom.co, based on published security research. It is not professional security, legal or financial advice.
There’s A Lot More To This
This Rapid Signal is the public layer. Seer members of The Rekindled get every daily briefing, weekly summaries and The Arsenal, including device compartmentation guides. Sage members also get weekly in-depth reports with forecasts.
