Apple iOS · Exploitation reported

Spyware infects out-of-date iPhones via the web; Apple urges updates

Oct 20, 2026 · 1 min read

Researchers at Report URI and iVerify report campaigns delivering the Coruna (iOS 13 to 17.2.1) and P7 DarkSword (iOS 18.4 to 18.7) spyware to out-of-date iPhones via websites, ads, and expired analytics tags; opening the page is enough, no click needed. A real infection was confirmed in August 2026 through an Instagram ad on a customer employee's device. Apple says updated devices are protected: install the latest iOS.

By HIFY Radar newsroom Updated 10/26/2026 01:17 PM Get this every day →← Back to the feed 5 sources

HighVulnerabilityExploitation reportedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Researchers at Report URI and iVerify reported campaigns that install spyware on out-of-date iPhones when users visit infected websites or see malicious ads, with no click required. The Coruna and DarkSword kits hit iOS versions from 13 through 18.7. Apple published guidance and says updated devices are protected.

Why it matters

The spyware steals keychain passwords, crypto wallet data, and device and account information, creating financial and account-access risk. Researchers say the delivery network reaches an estimated 135 million visits per month to sites that can serve the kits. iVerify reported a real infection on a customer employee who was simply scrolling Instagram.

What to do

Update every corporate and personal iPhone to the latest available iOS (iOS 26 or the newest update for iOS 15 through 18). Review and rotate credentials used on devices that ran vulnerable versions. Block the published indicators of compromise.

For the technical team

Affected: Apple iOS (Safari/WebKit) em iPhones desatualizados · iOS 13 to 17.2.1 (Coruna); iOS 18.4 to 18.7 (P7 DarkSword variant, AKS40).
Exploitation: Exploitation reported by Report URI and iVerify. Real infection confirmed in August 2026 on an iVerify customer employee device via a World Cup-themed Instagram ad served from ad-track[.]live. 660+ expired re-registered domains embedded on thousands of sites, with a cautiously estimated 135 million visits per month (researchers).
Fix: Latest iOS 26; latest updates for iOS 15 through 18. Apple states updated devices are protected and published guidance at support.apple.com (article 126776).
Vector: Safari/WebKit on out-of-date iOS. 'Half-click' exploitation: the page or ad loading is enough, no tap, link, or install. Reported vectors: expired analytics/ad tag domains re-registered by attackers (DeadTag campaign), malicious Instagram ads, and loaders planted on hundreds of PrestaShop stores.
More details: P7 DarkSword injects into the SpringBoard process; C2 beacon every 15 seconds; endpoints /a, /beacon, /event, /result, /u, /nb, /p, /war; commands include photos, apps, wallet_scan, wallet_extract (imToken), memo_scan, disk_scan; uses localStorage to prevent re-exploitation. Coruna and DarkSword exfiltrate to the same server; researchers assess one operator runs both. Report URI says the exploit crew looks at least Chinese-speaking (simplified Chinese code comments and Chinese-language sites); the DeadTag operator remains unattributed. Targeted wallets: Binance, Coinbase Wallet, OKX, Bitget, Trust Wallet, Exodus, TronLink, and Bitpie. The operation has placeholders for iOS 26 and 27, described as mostly non-functioning. A reboot may stop the implant, but data theft has likely already happened. C2 uses HTTP/1.0 POST with a hardcoded User-Agent; HTTPS without strict certificate validation.

Indicators (IoCs)

cdn[.]gotoiphone[.]com
mzpo30[.]cam/assets/js/group[.]html
agdx53[.]cc
js[.]gotoiphone[.]com/ios18
Hardcoded User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Mobile/15E148 Safari/604.1