Critical iOS zero-click flaw lets attackers spy via Instagram ads

Key Takeaways

• A critical zero-click vulnerability in iOS allows attackers to deploy spyware via malicious Instagram advertisements.
• The DarkSword P7 spyware variant was observed being delivered through a World Cup ad, compromising iPhones without user interaction.
• The attack leverages older iOS versions, but the method highlights the danger of malvertising and forgotten website tags.
• Sensitive data, including cryptocurrency wallet details, contacts, and passwords, are targets.
• Users are urged to update iOS, and organizations should implement robust security measures and monitor external scripts.

Sophisticated Spyware Delivered Through Instagram Ads Exploits iOS Flaw

A troubling new report reveals that threat actors are leveraging malicious advertisements on Instagram to inject spyware onto unsuspecting iPhones. This sophisticated attack vector allows for the deployment of malware, such as the DarkSword P7 variant, without requiring any user interaction beyond scrolling past the ad.

One documented incident involved a World Cup-themed advertisement that delivered the DarkSword P7 payload. This “zero-click” exploit enabled the extraction of sensitive user information from the compromised device, bypassing the need for the victim to tap the ad, download any files, or install an application. This method starkly illustrates how the digital advertising ecosystem can be weaponized for mobile cyberattacks, moving beyond traditional phishing tactics that rely on user persuasion.

The discovery of this DarkSword P7 infection was made by researchers from iVerify identified while investigating a corporate employee’s mobile device.

Malicious Instagram Ads Exploit iOS

A joint investigation with Report URI, published on October 21, 2026, details how criminal groups are exploiting advertising platforms and neglected website integrations to distribute two iOS exploit kits, DarkSword and Coruna. Both kits are capable of exfiltrating private data from compromised devices.

In the specific Instagram case, the employee’s iPhone was compromised simply by loading the malicious advertisement as they scrolled through their feed. The same individual later encountered a separate attack from a different group, which delivered another DarkSword variant via a malicious link. Fortunately, timely alerts enabled the organization’s security team to invalidate credentials before any stolen login information could be monetized or used against corporate systems.

The researchers characterize these incidents as “half-click” attacks. While users must actively visit a webpage or social media platform, no further interaction with the malicious content, such as clicking or downloading, is necessary for the exploit to trigger. It is important to note that this report does not describe attacks on idle phones without browsing activity, nor does it confirm vulnerabilities in fully updated iPhones.

Investigators have yet to determine precisely how the malicious Instagram advertisement bypassed Meta’s content moderation. Several theories are under consideration, including the use of concealed malicious code, exploitation of advertising resellers, or a compromise of a third-party vendor. None of these possibilities have been confirmed, and the observed infection highlights a delivery mechanism through advertising, not an inherent vulnerability within the Instagram platform itself.

The core of the compromise relies on vulnerabilities within older iOS software versions. Previous analyses of the Coruna and DarkSword exploits have detailed how chained browser and system flaws can allow attackers to bypass the browser’s security sandbox. The current investigation confirms that both exploit kits specifically target older iOS versions, with placeholders for newer releases not indicating active exploits against them.

DeadTag Operation Leverages Forgotten Website Tags for Spyware Delivery

Beyond the Instagram vector, Report URI also uncovered “DeadTag,” an operation that acquires expired domain names previously utilized for analytics and advertising services. Thousands of websites inadvertently continue to load scripts from these now-malicious domains due to forgotten or unmaintained tags.

Once threat actors gain control of these expired domains, the existing connections provide a stealthy conduit to redirect website visitors without needing to directly compromise each individual website. Investigators identified hundreds of re-registered domains, estimating a potential exposure of 135 million monthly visits to sites capable of serving spyware, provided visitors meet specific targeting criteria. This figure represents potential traffic exposure, not confirmed infections, as much of the redirected traffic leads to various scams, with Coruna or DarkSword delivered only to targeted iPhone users.

The exploit crew also deployed DarkSword loaders on hundreds of PrestaShop e-commerce stores, cleverly embedding them within folders designed to mimic legitimate analytics components. Some of these paths led to a deceptive Polymarket page. The identified spyware variants were designed to steal keychain passwords, device information, and cryptocurrency wallet details, including those from Binance, Coinbase Wallet, OKX, Bitget, Trust Wallet, Exodus, TronLink, and Bitpie.

The potential ramifications extend beyond financial theft. Both Coruna and DarkSword are capable of collecting messages, contacts, location data, and various passwords. For organizations, a compromised personal device can therefore become a critical entry point for corporate credentials, even if an employee never opens a suspicious attachment or knowingly installs malicious software.

While financial gain appears to be the primary motivation, Chinese-language code comments and related infrastructure suggest the operators may be Chinese-speaking, though this does not confirm nationality or state sponsorship. The individuals behind the DeadTag operation remain unidentified. This incident also echoes previous reports on how malicious website theme packages can expose iPhone users to spyware and wallet theft through seemingly legitimate websites.

What You Should Do

• Update iOS Immediately: Ensure all your Apple devices are running the latest version of iOS to patch known vulnerabilities.
• Enable Lockdown Mode: For users at elevated risk, consider activating Apple’s Lockdown Mode, understanding its functional restrictions.
• Exercise Caution with Ads: Be aware that even legitimate-looking advertisements can be weaponized. Avoid clicking suspicious ads and consider using ad blockers.
• Website Owners: Regularly audit and remove unused third-party tags, monitor all external scripts, and implement a robust Content Security Policy (CSP).
• Post-Compromise Protocol: If a compromise is suspected, preserve system logs before restarting, immediately change all exposed credentials, and transfer cryptocurrency assets to new wallets with fresh recovery phrases.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.