Malicious Instagram Ads And Hacked Sites Can Infect iPhones With Spywa

Malicious Instagram Ads And Hacked Sites Can Infect iPhones With Spyware

Criminals are using compromised websites and Instagram ads to target iPhones with spyware that steals cryptocurrency and personal data without any user interaction.

NationPulse Desk

Oct 23, 2026 · 7:27 PM 2 min read

Key takeaways

Cybercriminals are using compromised websites and Instagram ads to target iPhones with spyware.

The attacks can infect devices without any user interaction simply by displaying an ad or webpage.

Investigators identified 6,600 affected websites, with 248 directly distributing iPhone spyware.

The malware uses tools called Coruna and DarkSword to steal passwords, messages, and cryptocurrency.

Attacks mainly target iPhones running outdated versions of iOS that lack recent security patches.

Cybercriminals are targeting Apple devices using fraudulent online ads and hijacked internet domains to deliver spyware intended for harvesting digital currency and private data, Forbes reports. Infections happen passively when a vulnerable handset loads a malicious banner or visits an infected page, needing no clicks from the owner. Investigators from iVerify alongside Report URI spotted thousands of hacked web destinations distributing the harmful scripts, plus a separate vector operating via an Instagram promotion.

How the Attack Works

Investigators uncovered a campaign named DeadTag that leverages hijacked web portals and ad networks against iOS users. Forbes noted that at least 6,600 lawful websites suffered compromises, pulling in roughly 49 million visits every month, with 248 of those pages actively pushing iPhone spyware. The perpetrators deploy two specific software tools called Coruna and DarkSword that abuse security flaws within the operating system. Once a phone is breached, the surveillance software reaches credentials, text messages, address books, geographic coordinates, and digital asset wallet contents.

Instagram Ads Used to Spread Malware

Specialists also found a fraudulent promotional post on Instagram that transmitted DarkSword spyware onto an Apple device while the individual was browsing their feed. The ad featured a World Cup motif and demanded zero user engagement from the target. iVerify chief executive Rocky Cole stated that people face infection risks just by looking at normal web pages or social networks. The main objective of the hackers is stealing digital currency from compromised units.

Which iPhones Are at Risk?

The campaign primarily goes after handsets operating on older software releases, since Apple has already issued fixes for the exploited weaknesses. Still, units lacking the necessary security patches stay vulnerable. Experts advise updating handsets to the newest supported iOS release to defend against these exploits. Although thousands of web domains suffered contamination, the total count of successfully breached Apple devices is still unconfirmed.

Questions and answers

How do the iPhone spyware attacks infect devices?

The attacks infect vulnerable iPhones simply by displaying a malicious advertisement or opening an infected webpage, without requiring users to click anything.