Simply scrolling an Instagram feed can be enough to get spyware onto an iPhone. Researchers at iVerify documented a case in which a World Cup-themed advertisement delivered the P7 variant of DarkSword to a company-used phone, without the user tapping the ad, downloading a file or installing an app.
The delivery channel is what matters here. Phishing depends on persuading someone to open a suspicious link; in this case the infection occurred during ordinary browsing. The employee, working for an organisation that is a client of iVerify, was only scrolling when the ad loaded. Later the same device was hit by a different DarkSword variant, this time after clicking a link pushed by another group. Near-real-time alerts let the security team change credentials before the stolen data could be sold and used against corporate systems.
Research from iVerify and Report URI, published on 21 October, calls these "half-click" attacks: a page or social platform must be visited, but no further interaction is needed. A ottobre il Citizen Lab aveva già documentato "AdFection", uno spyware zero-click diffuso via pubblicità su app come Duolingo. The report does not show that an idle phone can be reached, nor that fully updated iPhones are vulnerable, since the exploits target older iOS versions.
How the ad passed Meta's checks remains unknown. Possibilities include concealed malicious content, abuse of advertising resellers or a compromised vendor, but none is confirmed. What is documented is an advertising delivery route, not a flaw in Instagram itself.
The same research describes DeadTag, an operation that buys expired domains once used by analytics and advertising services. Thousands of sites still load scripts from those domains through forgotten tags, so whoever controls a domain can redirect visitors without compromising each site. Researchers identified hundreds of re-registered domains and estimate 135 million monthly visits to pages able to serve the spyware, a figure that measures potential exposure rather than confirmed infections. Much of the traffic leads to scams, while a selection of iPhone visitors receives Coruna or DarkSword. The operators also planted DarkSword loaders on hundreds of PrestaShop stores.
Financial theft appears to be the main goal: the variants identified target keychain passwords, device data and crypto wallets such as Binance, Coinbase Wallet and Exodus. Chinese-language code comments suggest Chinese-speaking operators, but they do not establish nationality or state involvement. DeadTag's operators remain unidentified.
For companies the risk is indirect but real: a compromised personal phone can become a source of work credentials even without the employee opening an attachment or approving an installation.
The guidance is standard: install available iOS updates now; people at higher risk may consider Lockdown Mode, accepting its restrictions. Site owners should remove unused third-party tags and enforce a Content Security Policy. After a suspected compromise, researchers advise preserving logs before restarting, changing exposed credentials and replacing wallets with new recovery phrases.
No comments yet. Be the first!