An Instagram ad was all it took: Leaked exploit kits are hitting employees’ iPhones
Criminals are using leaked exploit kits to break into vulnerable iPhones, according to iVerify’s 2026 Advanced Mobile Threat Report. Attacks delivered through ads and compromised websites have reached employees who use phones for work.
DarkSword chains together several software flaws to compromise iPhones. Researchers disclosed the toolkit in March 2026, and a newer version appeared on GitHub within a week, giving criminal groups code they could adapt. Another toolkit, Coruna, was served from websites posing as finance and cryptocurrency services.
An attack can start when an ad loads
A DarkSword variant began infecting an iPhone when an Instagram ad loaded while its user was scrolling. The same person later clicked a link that delivered a different version of the toolkit. Researchers attributed the incidents to separate actors and assessed that both sought to steal cryptocurrency.
DeadTag, a traffic-selling operation documented by Report URI researcher Scott Helme, acquired an expired domain once used for e-commerce analytics. Some stores still referenced it in their website templates, so shoppers’ browsers fetched a script controlled by the new owner. The script sent some visitors through traffic brokers. One destination posed as a cryptocurrency trading site and quietly loaded a hidden page that checked for Safari on iOS 18.4.0 through 18.7.2, then launched the DarkSword exploit chain on matching iPhones.
A separate group bought traffic from DeadTag and deployed DarkSword and Coruna. Across the broader DeadTag network, thousands of websites loaded code from more than 660 re-registered domains. Report URI estimated that those sites received a combined 135 million visits a month. The researchers did not report how many phones were infected.
An infected personal phone can expose work accounts
DarkSword can extract passwords and other sign-in information from the iPhone’s Keychain. If an employee uses a personal phone for work email, messaging or remote access, stolen credentials or session tokens could give attackers access to company services. One Coruna payload searched text and images for recovery phrases that could give attackers control of a cryptocurrency wallet.
“Credential theft is big business for cyber criminals. Groups like Scattered Spider and ShinyHunters have used social engineering and stolen identities to break into corporate networks and extort millions of dollars,” said Brad Arkin, principal at LeverSec and former chief trust officer at Salesforce.
“DarkSword and Coruna give criminals another way in. Between them, they can pull stored passwords, messages, notes, and photos from an iPhone and steal cryptocurrency. If an employee’s phone is infected, that person’s legitimate credentials can become the starting point for a much larger breach, and the login would look like normal activity.”
Nearly 1 in 900 iOS consumer scans shows signs of spyware (Source: iVerify)
Criminals seeking credentials or cryptocurrency accounted for three-quarters of detections. Every enterprise detection of DarkSword or Coruna involved an employee at or below managing-director level. The conservative estimate for monitored consumer iOS devices was 1.07 spyware infections per 1,000 devices.
Evidence can disappear before an investigation
Some traces of DarkSword remain on an iPhone for only a short time. A reboot or software update can remove the running malware and erase evidence that could help investigators reconstruct the attack.
The researchers were unaware of any Apple threat notifications sent to devices on which they had confirmed a DarkSword or Coruna infection. Apple uses those alerts to warn people it believes may have been individually targeted by mercenary spyware.
