Ad platform says malware ads fingerprint iOS before payload
Original title: PropellerAds: Why Modern Malware Delivery Starts Before the Payload
ADEX linked about 50 advertiser accounts by shared cloaking behavior and says that does not mean they delivered Coruna.
An AdTech Holding compliance lead describes malware delivery as acquisition, routing, trusted hosting, visitor qualification and persuasion, citing Google's March 2026 disclosure of the Coruna iOS exploit kit. Coruna fingerprinted devices and ran a matching exploit only for selected iPhone models and iOS versions from 13.0 through 17.2.1. Separately, ADEX says it found about 50 advertiser accounts using the same qualify-first chain and passed them to platforms, which reviewed the accounts. ADEX's 2026 moderation review also breaks out cloaking, malicious iOS scripts and infected domains as suspension or rejection reasons.
Unconfirmed: ADEX says the similar delivery setup does not mean Coruna itself was served through those ad campaigns.
- Coruna had five exploit chains and 23 exploits and skipped researchers, scanners, Lockdown Mode and private browsing.
- Check Point described fake open-source download sites loading a staging script from Amazon CloudFront.
- Those TDS scripts were in place by December 2025; malware distribution began in January 2026.
- In Q3 2026, malicious iOS scripts were about 20% of suspensions and cloaking about 45%, per ADEX.
- ADEX says baselines differ by row, so the table is a changing mix, not a like-for-like trend.
Impact: Selective delivery of iOS exploits after device fingerprinting
| Product | Affected |
|---|---|
| Apple iOS | 13.0 through 17.2.1 |
- 1.Treat landing pages that fingerprint OS version and load a version-specific script as suspicious before a payload is retrieved.
From the original article
6 min read at cybersecuritynews.com
By Farukh Rakhimov, Head of Compliance, Data Protection, and Information Security at AdTech Holding In March 2026, Google Threat Intelligence Group (GTIG) disclosed Coruna, an iOS exploit kit with five exploit chains and 23 exploits covering iOS 13. 0 through 17. 2.
By Kaaviya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.