Cybercriminal groups are using malicious Instagram advertisements, abandoned analytics tags, and compromised websites to deliver Coruna and DarkSword exploit kits to vulnerable iPhones.
The investigation exposes a scalable spyware distribution model in which attackers exploit advertising infrastructure to reach victims during ordinary browsing.
Researchers describe these as “half-click” attacks: users must encounter an infected webpage or advertisement, but exploitation can begin automatically when malicious content loads.
The employee was scrolling through their feed when the malicious advertising content loaded.
The same individual subsequently encountered a separate group distributing another DarkSword variant through a malicious link.
Near-real-time alerts allowed the organization’s security team to rotate credentials before stolen information could be resold or used for corporate intrusion.
Researchers have not established how the malicious advertisement passed Meta’s screening. Compromised intermediaries, obfuscated delivery chains, and screening failures remain possible explanations, not confirmed findings.
Report URI identified a parallel operation, dubbed DeadTag, that purchases expired domains previously associated with advertising and analytics services.
Thousands of websites still reference these domains through forgotten third-party script tags.
iVerify Researchers observed that, the P7 variant of DarkSword reaching an employee’s iPhone through a World Cup-themed Instagram advertisement served from ad-track[.]live.
Once attackers acquire a domain, those existing integrations become traffic sources under criminal control.
Coruna and DarkSword Target iOS
DeadTag redirects visitors toward scams while selectively routing qualifying iPhones to Coruna and DarkSword delivery infrastructure.
Researchers identified hundreds of abused domains embedded across thousands of websites, including recognizable brands.
Sites within the investigation’s current scope collectively receive approximately 135 million monthly visits.
That figure measures potential exposure across participating websites, not confirmed infections or unique victims.
The operation also contains placeholders for routing devices running iOS 26 and 27. However, researchers said observed attempts to adapt the exploit kits for those versions were largely nonfunctional, not evidence of successful exploitation.
The exploit operators also compromised hundreds of PrestaShop stores, hiding DarkSword loaders inside directories resembling analytics components. Another retailer simultaneously loaded both exploit kits.
A fraudulent Polymarket page delivered Coruna and P7 DarkSword, with stolen information flowing to the same server, connecting both payloads to one operator.
Observed variants targeted keychain passwords, account information, and cryptocurrency applications, including Binance, Coinbase Wallet access, OKX, Bitget, Trust Wallet, Exodus, TronLink, and Bitpie.
Chinese-language development comments and related cryptocurrency infrastructure suggest a Chinese-speaking, financially motivated operation.
They do not establish nationality or state sponsorship. DeadTag’s operators remain unidentified.
The findings parallel Citizen Lab’s AdFection investigation, which connected Discover-Tech advertisements to Candiru infections at Al Jazeera.
That research documented targeted surveillance; the latest investigation shows comparable advertising mechanisms supporting broader criminal distribution.
Website administrators should remove obsolete integrations, monitor newly introduced scripts and domains, and enforce a restrictive Content Security Policy.
An abandoned tag remains executable infrastructure, even after its original provider disappears.
iPhone users should install current security updates. Higher-risk users should consider Lockdown Mode. Organizations investigating suspected compromise should preserve forensic evidence and rotate exposed credentials.
The central shift is distribution: sophisticated iPhone exploitation no longer depends exclusively on individually selected targets.
Criminal traffic brokers can supply vulnerable devices through advertising systems and neglected website dependencies at scale, reducing delivery costs.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
