Malicious Instagram Ads Can Infect Vulnerable iPhones Without Users Clicking Anything – Cyber Press

Cybercriminals are using malicious Instagram advertisements and abandoned website tracking tools to infect vulnerable iPhones without requiring users to click the ads. Report URI describes campaigns delivering Coruna and DarkSword, two powerful iOS exploit kits, through advertising infrastructure.The researchers call these “half-click” attacks. Users must visit an affected website or browse a social media feed, but infection happens automatically when malicious advertising content loads. The findings concern vulnerable iOS versions, not every iPhone.In one incident, iVerify detected the P7 variant of DarkSword inside a World Cup-themed Instagram advertisement served from ad-track[.]live. An employee’s device was infected while they scrolled through their feed.The same employee later encountered another DarkSword variant through a malicious link distributed by a separate group. Security alerts allowed the organization to rotate credentials before attackers could use stolen information for corporate access.Report URI identified a traffic operation called DeadTag that buys expired domains previously used by advertising and analytics services. Thousands of websites still request scripts from these domains, allowing their new owners to redirect visitors toward malicious content.Most traffic reaches scams, but qualifying iPhone visitors receive Coruna or DarkSword. Researchers identified hundreds of reused domains embedded across thousands of websites.The affected websites collectively receive approximately 135 million monthly visits. That figure describes potential exposure through those sites, not confirmed infections or unique compromised devices.Investigators also found DarkSword loaders on hundreds of PrestaShop stores, hidden inside folders resembling analytics components. Another clothing retailer loaded both exploit kits from infrastructure connected to additional websites.The research follows Citizen Lab’s separate AdFection investigation, which linked Discover-Tech advertisements to Candiru spyware infections at Al Jazeera. That case demonstrated how targeted advertising can deliver spyware automatically when an advertisement renders.For the Instagram campaign, researchers have not established how the malicious advertisements passed Meta’s screening. Possible explanations remain unconfirmed.The observed payloads target passwords and secrets stored in the iPhone keychain, cryptocurrency applications, and device information. Targeted wallet applications include Coinbase Wallet, Trust Wallet, Exodus, TronLink, Bitpie, OKX and Bitget.Researchers linked delivery of both exploit kits to one operator because stolen information reached the same server. Financial theft appears to be the main motive, although collected information could support additional criminal activity.DeadTag’s operators remain unidentified. Chinese-language code comments and infrastructure associated with Chinese-language cryptocurrency and gambling websites suggest a Chinese-speaking exploit crew, but do not establish nationality or government involvement, iVerify said.Researchers observed preparations for targeting iOS 26 and 27, but described attempted adaptations as mostly nonfunctional. These findings do not demonstrate working exploit chains against those versions.iPhone users should install available iOS security updates promptly. People facing elevated risk should consider Lockdown Mode, while organizations should monitor mobile devices and investigate suspicious activity.Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team Exclusive Cyber Security News platform that provide in-depth analysis about Cyber Attacks, Malware infection, Data breaches, Vulnerabilities, New researches & other Cyber stories. Contact Us: cyber.press@outlook.com© Copyright 2026 – Cyber Presssource