iVerify finds leaked DarkSword kit compromising employees’ iPhones via Instagram ads

iVerify released its Advanced Mobile Threat Report 2026 on November 10, 2026, finding criminal groups used leaked mobile exploit kits to compromise employees’ iPhones.

Help Net Security reported on November 11, 2026, that infections reached staff using phones for work through malicious ads and compromised websites. Researchers observed a DarkSword variant begin infecting an iPhone after a malicious Instagram advertisement loaded during scrolling, with no tap required. Malicious ads can deliver DarkSword through a half-click technique where infection starts when an ad loads, requiring no further interaction.

iVerify’s telemetry showed 1.07 spyware infections per 1,000 monitored consumer iOS devices, or nearly one in 900 scans. Every enterprise detection tied to DarkSword or Coruna reached staff ranked managing director or lower. Researchers found no Apple threat notifications on devices confirmed infected with DarkSword or Coruna.

Google, Lookout, and iVerify researchers disclosed DarkSword on March 18 after linking it to surveillance vendors and suspected state-sponsored actors. Within a week, a newer version surfaced on GitHub, handing criminal groups adaptable code and giving them a starting point for variants without having to find every vulnerability on their own. TechCrunch reported on March 23, 2026, that someone leaked a newer DarkSword version and published it on GitHub.

Matthias Frielingsdorf, co-founder of iVerify, said the leaked DarkSword files are HTML and JavaScript that anyone can host on a server in minutes to hours, and that the exploits work out of the box with no iOS expertise required. A Google spokesperson agreed with Frielingsdorf’s assessment. “This is bad. They are way too easy to repurpose,” Frielingsdorf said.

The toolkit pulls stored passwords and sign-in data from the iPhone Keychain. Modified DarkSword versions found by iVerify can gather extra passwords, messages, photos, and cryptocurrency wallet details. Variants went after keychain passwords, device information, and wallets including Binance, Coinbase Wallet, OKX, Bitget, Trust Wallet, Exodus, TronLink, and Bitpie. The kits gather messages, contacts, location data, and passwords and target cryptocurrency.

Apple patched all six DarkSword vulnerabilities by iOS 26.3. Keeping iOS updated is a key defense because patches close vulnerabilities criminals continue to exploit. iVerify says mobile security monitoring should extend beyond executives, particularly for staff using personal devices for work tasks.

Google’s Threat Intelligence Group says Coruna consists of 23 exploits across five attack chains targeting iOS 13 through iOS 17.2.1. The toolkit compromised iPhones on iOS 18.4 to iOS 18.7 by exploiting six vulnerabilities to extract sensitive information. A Coruna variant scanned device text and images for wallet recovery phrases.

Coruna was originally developed by defense contractor L3Harris through its Trenchant division for the U.S. government and allies. GTIG followed Coruna through three separate threat-actor ecosystems during 2025. Coruna targeted Apple devices running iOS releases from September 2019 through December 2023. A threat actor accidentally exposed Coruna’s internal code names and documentation by deploying a debug version.

In February 2025, the earliest Coruna activity used a JavaScript framework to fingerprint devices by iPhone model and iOS version before delivering a tailored exploit. After identifying a compatible target, Coruna triggered a WebKit remote code execution flaw followed by a Pointer Authentication Code bypass. By summer 2025, Coruna infrastructure appeared in campaigns linked to Russian espionage group UNC6353 targeting Ukrainian websites.

Dozens of compromised Ukrainian websites received injected malicious code from attackers, who served exploits through a hidden iFrame on cdn.uacounter.com. The exploit selectively triggered only for iPhone users in specific geographic regions. In 2025, Coruna appeared in activity by a surveillance vendor customer and then by a suspected Russian espionage group against Ukrainian sites.

In late 2025, a financially motivated Chinese group tracked as UNC6691 used Coruna across fraudulent cryptocurrency and financial websites. One fake site impersonating the WEEX cryptocurrency exchange displayed pop-up prompts urging iPhone users to visit and trigger the exploit. A financially motivated Chinese group later used Coruna in widespread attacks.

Report URI put the combined monthly visits to those sites at 135 million, a potential traffic exposure across sites that could serve spyware to targeted visitors, not confirmed infections. Report URI tied DeadTag to an operation that purchases expired domains formerly used by analytics and advertising providers. Scott Helme of Report URI documented DeadTag as a traffic-selling operation that took control of an expired domain used for e-commerce analytics.

DeadTag’s broader network covered thousands of websites pulling code from over 660 re-registered domains. Forgotten tags on thousands of websites still request scripts from expired domains, allowing new owners to redirect visitors without compromising each site directly. Visitors following certain paths reached a fake Polymarket page instead of the intended store.

Hundreds of PrestaShop stores received hidden DarkSword loaders placed inside folders that resemble analytics components. A DeadTag landing page checked Safari versions from iOS 18.4.0 through 18.7.2 before launching DarkSword on matching iPhones. Researchers have not identified the operators behind DeadTag.

Researchers did not disclose the number of infected phones in the DeadTag campaign. Some DarkSword traces remain on an iPhone only briefly, and a reboot or update can remove the malware and erase evidence.

Stolen credentials or session tokens from a personal phone used for work can let attackers reach company services. Security teams used near-real-time alerts to rotate credentials after the intrusion, blocking sale and corporate use of stolen login details.

The report attributes three-quarters of detections to criminals seeking credentials or cryptocurrency. The main motive appears to be financial theft, while Chinese-language code comments and associated infrastructure point to Chinese-speaking operators but do not prove nationality or government ties.

SlowMist and OKX researchers discovered malicious components in FomoPeek versions 1.1 and 1.2, a cryptocurrency monitoring app distributed through Apple’s App Store in September. SlowMist traced about $580,000 in stolen USDT to a cryptocurrency address associated with FomoPeek. The malicious FomoPeek versions surfaced on September 9 and September 12, and an update removed the components on September 17.

Researchers found that a World Cup-themed Instagram advertisement from ad-track[.]live contained the DarkSword P7 variant. Researchers observed preparations for targeting iOS 26 and iOS 27, but described the attempted adaptations as nonfunctional.

The report says AI is speeding up exploit creation, but iVerify testing showed suspected AI-assisted DarkSword adaptations for newer iOS versions failed to exploit test devices. Apple’s threat notifications are designed for people believed to be individually targeted by mercenary spyware based on identity or activities. The absence of an Apple warning does not prove the system failed or that a device is uncompromised.

About one-quarter of iPhone and iPad users still run iOS 18 or earlier, likely hundreds of millions of vulnerable devices. On March 11, Apple released an emergency update for devices that cannot run recent versions of iOS.

The code is allegedly tied to Russian government hackers who targeted Ukrainian systems with DarkSword. A security hobbyist using the handle matteyeux said he hacked an iPad mini running iOS 18 with a circulating DarkSword sample.

Coruna includes key vulnerabilities CVE-2021-30952, CVE-2023-32409, CVE-2023-32434, CVE-2024-23222, and CVE-2024-23225. Two Coruna exploits, Photon and Gallium, were associated with Kaspersky’s 2023 Operation Triangulation. Coruna stops exploitation when Apple Lockdown Mode is active.

Google could not establish exactly how Coruna passed between operators. Researchers said the same individual later followed a malicious link that delivered another DarkSword variant, and attributed the two incidents to separate actors seeking cryptocurrency.