Instagram Ads Push iPhone Spyware Kits

Researchers found criminals using World Cup-themed Instagram advertisements, compromised websites, and abandoned analytics tags to expose iPhone users to Coruna and DarkSword spyware kits. The attacks can begin when malicious advertising or web content loads, with little or no action beyond visiting the affected page. The campaign also targeted passwords, account information, and cryptocurrency apps.

Key findings

• A World Cup-themed Instagram advertisement delivered the P7 DarkSword variant to an employee's iPhone.
• The DeadTag operation buys expired advertising and analytics domains that remain embedded as third-party tags on thousands of websites.
• Attackers selectively routed qualifying iPhones to Coruna and DarkSword exploit infrastructure.
• Compromised PrestaShop stores hid DarkSword loaders in directories made to resemble analytics components.
• Observed spyware sought keychain passwords, account information, and cryptocurrency application data.
• The article describes 'half-click' attacks, where exposure to malicious advertising or a webpage can trigger exploitation when content loads.

Who’s being targeted

• Commonly targeted roles: Employees using iPhones, Mobile device users, Security operations teams, Website administrators, Web developers, IT administrators, High-risk executives and staff.
• Affected industries: Information and Media, Retail and E-commerce, Financial Services, Cryptocurrency Services.
• Attack channels: website.
• Impersonated: World Cup-themed advertiser, Third-party advertising or analytics service.

Awareness takeaways

• Treat unexpected advertisements and redirects on mobile devices as potential security incidents, especially when they occur while browsing ordinary websites or social feeds.
• Keep iPhones updated promptly, and consider Lockdown Mode for staff who face elevated targeting risk.
• Website owners should remove abandoned third-party tags and restrict which scripts and domains their sites may load.
• If spyware exposure is suspected, preserve evidence and rotate potentially exposed credentials quickly.

Red flags to watch for

• An unexpected advertisement routes to an unfamiliar domain.
• The ad or page causes an unexpected redirect.
• A mobile browser opens content unrelated to the advertised promotion.
• A site relies on an old or unfamiliar third-party analytics domain.
• Unexpected redirects occur after visiting a legitimate-looking site.
• A formerly valid third-party tag points to an expired or newly repurposed domain.