Researchers reported real iPhone compromises delivered through Instagram ads and websites that impersonated cryptocurrency services. The attacks used leaked exploit kits to steal stored passwords, session information, messages, and cryptocurrency wallet recovery phrases, potentially turning an employee’s personal phone into a route into company accounts.
Researchers documented real iPhone compromises that began with everyday browsing. In one case, a DarkSword variant began infecting an iPhone simply when an Instagram ad loaded while its user was scrolling, no app download or credential entry was needed. In another path, an expired e-commerce analytics domain still embedded in store templates redirected some visitors through traffic brokers. One of those redirect destinations posed as a cryptocurrency trading site and quietly loaded a hidden page that checked for Safari on iOS 18.4.0 through 18.7.2, then launched the DarkSword exploit chain on matching iPhones. A second toolkit, Coruna, searched text and images on the device for cryptocurrency wallet recovery phrases.
The attack chain avoided the usual red flags that awareness training focuses on. There was no phishing email, no suspicious attachment, and no login form asking for a password. Instead, exposure came from passive ad loading and a redirect chain that most users would never notice, since sponsored ads and occasional redirects from shopping sites are considered normal. The exploit also selectively targeted specific iOS version ranges, meaning devices that were not kept current were more exposed, while the use of a legitimate-looking cryptocurrency trading impersonation added a thin layer of plausibility if a user did pay attention to the destination.
Organizations with bring-your-own-device programs should treat personal phones as a genuine extension of the attack surface. If an employee uses a personal phone for work email, messaging or remote access, stolen credentials or session tokens could give attackers access to company services, and if an employee's phone is infected, that person's legitimate credentials can become the starting point for a much larger breach while the login looks like normal activity. Keeping iPhones updated promptly matters directly, since the exploit chain checked for specific older iOS versions before attacking. Employees should also be encouraged to treat unexpected ads, redirects, and links to cryptocurrency or financial services with caution, particularly on mobile devices. Finally, if compromise is suspected, employees and IT teams should report it immediately and avoid rebooting or updating the device where possible, since a reboot or software update can remove the running malware and erase evidence that could help investigators reconstruct the attack.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A DarkSword variant began infecting an iPhone simply when an Instagram ad loaded while its user was scrolling, with no download or credential entry required.
A hidden page checked for Safari on iOS 18.4.0 through 18.7.2 before launching the DarkSword exploit chain on matching iPhones.
DarkSword can extract passwords and other sign-in information from the iPhone Keychain, and a related tool, Coruna, searched text and images for cryptocurrency wallet recovery phrases.
If an employee uses a personal phone for work email, messaging or remote access, stolen credentials or session tokens could give attackers access to company services.
An Instagram ad loads. Your iPhone could be compromised before you tap. That happened with DarkSword. Another route redirected shoppers to a fake crypto trading site. A hidden page checked Safari on iOS 18.4.0 through 18.7.2, then launched the exploit. The surprise? No password entry needed. DarkSword can pull Keychain sign-ins, including work accounts. Coruna searched messages and images for crypto wallet recovery phrases. If your phone hit a suspicious ad or redirect, report it to security immediately, before rebooting or updating erases evidence.
APT29-linked operators compromised trusted websites and a web-analytics supplier to silently target visitors’ mobile devices. Related campaigns also used World Cup-themed ads, fake prize pages, and instructions to open pages in Safari to steer iPhone users toward browser exploits. The practical…
Researchers found criminals using World Cup-themed Instagram advertisements, compromised websites, and abandoned analytics tags to expose iPhone users to Coruna and DarkSword spyware kits. The attacks can begin when malicious advertising or web content loads, with little or no action beyond…
China-linked espionage campaigns used compromised websites to show selected visitors a fake Chrome certificate warning and persuade them to install a “Certificate Fix” utility. The same malware was also delivered to Indonesian organizations in phishing emails using a shortcut file disguised as a…
A gray-market service persuaded employees to install genuine OpenAI Codex and Anthropic Claude Code tools, then run a follow-up setup command that redirected the tools through relay servers it controlled. The configuration changes could expose every prompt, file, and login token sent through the…
The article describes real malware-delivery operations that use fake open-source download sites, advertising redirects, and device profiling to decide who receives malicious content. Attackers hide the final payload behind ordinary-looking pages and scripts, while sending researchers, bots, and…
Attackers used paid Google ads to direct people to fake Claude download pages hosted on Anthropic’s real claude.ai website. The pages used a ClickFix trick: they told Mac and Windows users to paste a command into their device, installing password- and cryptocurrency-stealing malware. Because the…
