SilentDelivery uses fake Chrome warnings to install Sparrow backdoor
Check Point says compromised sites push a Windows installer; the chain does not show a Chrome vulnerability.
1
Stories per day · 30 days
1 RSS
Relatedcoruna2darksword2adfection1al-jazeera1apple-notes1candiru1china-linked1citizen-lab1clickfix1cloudflare1cryptocurrency1cryptocurrency-wallets1discover-tech1initial-access1instagram-ads1ios1ios-spyware1iphone1
11 stories, newest first · one card per story
Stories tagged #drive-by
DarkSword iOS chain escapes Safari and steals Apple Notes
Zimperium says a tested iOS 18.6.2 device uploaded NoteStore.sqlite and an inventory of 214 apps to attacker infrastructure.
Fake Cloudflare checks on hacked sites push ClickFix commands
SANS could not retrieve the Windows or macOS payload after test fetches returned HTTP 403 or failed to resolve.
2
Crypto thieves infect iPhones via ads on hundreds of compromised sites
iVerify says victims only need to view an ad, including one served on Instagram.
1
Instagram ads deliver DarkSword spyware to vulnerable iPhones without a tap
iVerify and Report URI say DarkSword P7 and Coruna hit older iOS via ads and reclaimed domains, not proven on fully updated phones.
Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026
Unit 42 says September 2026 intrusions most often began with edge exploits and abused credentials.
2
Just Viewing an Online Ad Can Infect Your Device With Spyware, Researchers Reveal
Citizen Lab says Candiru spyware reached Al Jazeera devices through zero-click code hidden in online advertisements.
Fake iPhone Duo preorder scam triggers DarkSword attack
A fake iPhone Duo preorder page uses the patched DarkSword chain to steal iPhone data on visit.
Discovering and exploiting a remote code execution vulnerability in OpenCode (GHSA-632h-h47v-g4x4)
Datadog demonstrates remote code execution in OpenCode AI coding agent via content-type confusion in the /global/upgrade endpoint, fixed in 1.18.22.
Campaign Evolution: pseudo
Unit 42 traces the pseudo-Darkleech campaign's 2016 shift from Angler to Neutrino to Rig exploit kits and rotating ransomware payloads.
Locky Ransomware Installed Through Nuclear EK
Unit 42 reports Locky ransomware delivered through the Nuclear exploit kit using Flash exploits, adding a drive-by path to existing malspam distribution.
2