Hackers Use Malicious Instagram Ads to Infect iPhones With Spyware Without a Click

Hackers are using malicious Instagram advertisements to infect vulnerable iPhones with spyware while users scroll through their feeds.

A documented attack used a World Cup advertisement to deliver the P7 variant of DarkSword, exposing sensitive information without requiring the victim to tap the ad, download a file, or install an application.

The findings show how online advertising can become a delivery channel for mobile attacks. Unlike phishing, these infections do not depend on persuading someone to open a suspicious link.

Earlier reporting on spyware delivered through advertisements documented a separate campaign, highlighting how advertising infrastructure can help attackers reach devices during ordinary browsing.

Researchers from iVerify identified the DarkSword P7 infection while investigating an employee’s mobile device at a customer organization.

Hackers Use Malicious Instagram Ads

Their joint investigation with Report URI, published October 21, 2026, describes criminal groups abusing advertisements and abandoned website integrations to distribute DarkSword and Coruna, two iOS exploit kits capable of stealing private data.

In the Instagram case, the employee was simply scrolling when the malicious advertisement loaded. The same person later faced another attack after clicking a malicious link distributed by a different group using another DarkSword variant.

Near-real-time alerts allowed the organization’s security team to rotate credentials before stolen login details could be sold and used against corporate systems.

The researchers describe these as “half-click” attacks: users must visit a webpage or social platform, but no further interaction with the malicious content is necessary.

This distinction matters. The report does not describe an attack that reaches an idle phone without browsing activity, nor does it establish that fully updated iPhones are vulnerable.

Investigators have not established how the Instagram advertisement passed Meta’s checks. They discuss several possibilities, including concealed malicious content, abuse of advertising resellers, or a compromised vendor.

None is confirmed. The observed infection demonstrates an advertising delivery route, not proof of a vulnerability in Instagram itself.

The underlying compromise depends on vulnerable iOS software. Previous analysis of Coruna and DarkSword exploits explains how linked browser and system flaws can move an attacker beyond the browser’s safety boundaries.

In this investigation, both kits target older iOS versions; placeholders for newer releases do not demonstrate working exploits against them.

DeadTag Expands Spyware Delivery Through Forgotten Website Tags

Report URI also uncovered DeadTag, an operation that buys expired domains previously used for analytics and advertising services. Thousands of websites still load scripts from those domains through forgotten tags.

Once attackers control a domain, those existing connections give them a way to redirect visitors without first compromising each website directly.

The researchers identified hundreds of re-registered domains and estimated 135 million monthly visits to sites capable of serving the spyware when visitors meet targeting conditions.

That figure measures potential traffic exposure, not confirmed infections. Much of the redirected traffic leads to scams, while selected iPhone visitors receive Coruna or DarkSword.

The exploit crew also planted DarkSword loaders on hundreds of PrestaShop stores, hiding them in folders resembling analytics components. Some paths led to a fake Polymarket page.

The identified variants targeted keychain passwords, device information, and wallets including Binance, Coinbase Wallet, OKX, Bitget, Trust Wallet, Exodus, TronLink, and Bitpie.

The potential damage extends beyond cryptocurrency. Both exploit kits can collect messages, contacts, location information, and passwords.

For employers, a compromised personal phone can therefore become a source of corporate credentials, even when the employee never opens a suspicious attachment or knowingly approves an installation.

Financial theft appears to be the main motive. Chinese-language code comments and related infrastructure suggest Chinese-speaking operators, but do not establish nationality or state involvement.

DeadTag’s operators remain unidentified. Separately, previous reporting on malicious website theme packages shows how browser-side dependencies can expose iPhone visitors to spyware and wallet theft through trusted-looking websites.

Users should install available iOS security updates promptly. People facing elevated risk should consider Lockdown Mode, acknowledging its restrictions.

Website owners should remove unused third-party tags, monitor external scripts, and enforce a Content Security Policy.

Following suspected compromise, the researchers recommend preserving logs before restarting, changing exposed credentials, and replacing affected cryptocurrency wallets with new recovery phrases.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Use Malicious Instagram Ads to Infect iPhones With Spyware Without a Click appeared first on Cyber Security News.