Instagram ads used to deliver Coruna and DarkSword to iPhones
The DeadTag operation also abuses expired analytics domains referenced by sites that together draw about 135 million monthly visits.
74
Organization
Report URI
- Mentions · 7d2
- Mentions · 30d2
- All mentions3
- First seenSep 23, 2026
- Last mentioned3d ago
Timeline
3 articles · newest firstInstagram ads deliver DarkSword spyware to vulnerable iPhones without a tap
iVerify and Report URI say DarkSword P7 and Coruna hit older iOS via ads and reclaimed domains, not proven on fully updated phones.
72
Weekly Update 522: Live From Oslo with Scott Helme
Troy Hunt and Scott Helme discuss detecting malware-infected machines via CSP reporting and a surge of malicious browser extensions found with a local LLM.
12
Appears with
- Corunamalware · 2
- Instagramproduct · 2
- Metavendor · 2
- iVerifyorganization · 2
- DarkSwordmalware · 2
- Applevendor · 2
- iOSproduct · 2
- DarkSword P7malware · 1
- DeadTagthreat actor · 1
- DeadTagmalware · 1
- iPhoneproduct · 1
- PrestaShopproduct · 1
- Scott Helmeorganization · 1
- Troy Huntorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.