Instagram ads deliver DarkSword spyware to vulnerable iPhones without a tap
Original title: Hackers Use Malicious Instagram Ads to Infect iPhones With Spyware Without a Click
iVerify and Report URI say DarkSword P7 and Coruna hit older iOS via ads and reclaimed domains, not proven on fully updated phones.
iVerify and Report URI documented an employee iPhone infected with DarkSword P7 while scrolling a World Cup Instagram ad, without a tap, download, or install. The October 21, 2026 report says groups also distribute DarkSword and Coruna through DeadTag, which buys expired analytics domains still loaded by forgotten website tags, and through loaders on PrestaShop stores. The kits target older iOS and can collect keychain passwords, messages, contacts, location, and crypto wallets. How the ad passed Meta’s checks, and operator nationality, remain unconfirmed.
Unconfirmed: Meta ad-review bypass methods are unconfirmed, DeadTag operators are unidentified, and Chinese-language comments do not establish nationality or state involvement.
- The malicious World Cup ad was served from ad-track[.]live.
- DeadTag covers hundreds of re-registered domains and an estimated 135 million monthly visits, not confirmed infections.
- Loaders were planted on hundreds of PrestaShop stores, some leading to a fake Polymarket page.
- Named wallet targets include Binance, Coinbase Wallet, OKX, Bitget, Trust Wallet, Exodus, TronLink, and Bitpie.
- A later click-based attack used a different DarkSword variant; credentials were rotated before resale.
Impact: Steals keychain passwords, messages, contacts, location, and wallets
| Product | Affected |
|---|---|
| Apple iOS | older iOS versions |
- 1.Install available iOS security updates; consider Lockdown Mode if risk is elevated.
- 2.Remove unused third-party tags, monitor external scripts, and enforce a Content Security Policy.
- 3.After suspected compromise, preserve logs, change credentials, and replace affected crypto wallets.
- Products
- InstagramiOSPrestaShop
- Threat actors
- DeadTag
- Malware
- DarkSwordCorunaDarkSword P7
- Organizations
- iVerifyReport URI
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ad-track.live | of compromise (IoCs):- Type Indicator Observed role Domain ad-track[.]live Served the malicious World Cup Instagram advertisement de |
From the original article
3 min read at cybersecuritynews.com
Hackers are using malicious Instagram advertisements to infect vulnerable iPhones with spyware while users scroll through their feeds. A documented attack used a World Cup advertisement to deliver the P7 variant of DarkSword, exposing sensitive information without requiring the victim to tap the ad, download a file, or install an application. The findings show how […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.