Malicious Instagram Ads Deliver iPhone Spyware With No Tap Required

A booby-trapped Instagram advertisement has been caught infecting an employee's iPhone with spyware while the user was doing nothing more than scrolling their feed. The ad, themed around the World Cup, delivered a variant of the DarkSword iOS exploit kit. No tap, no download and no app install were needed.

What happened

The infection surfaced during a check of a staff member's personal phone at an organization that runs mobile threat detection. The ad loaded in the Instagram feed and the exploit chain ran on its own, with nothing visible to the user. Later, the same person was hit again by a different DarkSword variant, this time through a malicious link sent by what appears to be a separate crew.

The attack is better described as "half-click": the victim must be on a page or platform where the ad appears, but needs to take no further action. It is not a zero-interaction attack on a phone sitting idle, and it has not been shown to work against fully patched iPhones. Both exploit kits seen in this campaign, DarkSword and Coruna, target older iOS versions. The code contains placeholders for newer releases but no working exploits for them.

How the ad got past Meta's review is unknown. Possible explanations include cloaked ad content that behaves differently during review, abuse of advertising resellers, or a compromised advertising vendor. None has been confirmed, and nothing indicates a flaw in Instagram itself. Instagram was simply the delivery channel.

The domain that served the malicious ad was ad-track[.]live (deliberately defanged so it cannot be opened by accident).

A second delivery route: forgotten website tags

The same crew runs a broader distribution scheme, tracked as DeadTag. It buys up expired domains that once belonged to analytics and advertising services. Thousands of websites still load scripts from those domains through tags nobody ever removed. Once the attackers own the domain, every one of those sites quietly becomes a redirector, without any of them being hacked directly.

Hundreds of re-registered domains have been identified, with an estimated 135 million monthly visits to sites capable of serving the spyware when a visitor matches the targeting criteria. That number measures potential exposure, not confirmed infections. Most redirected visitors land on ordinary scams. Selected iPhone users on vulnerable iOS versions receive Coruna or DarkSword instead.

DarkSword loaders were also found planted on hundreds of PrestaShop e-commerce stores, hidden in folders made to look like analytics components. Some of those paths led to a fake Polymarket page used as a lure.

What the spyware steals

The variants observed go after keychain passwords, device information and cryptocurrency wallets, including Binance, Coinbase Wallet, OKX, Bitget, Trust Wallet, Exodus, TronLink and Bitpie. Both kits can also harvest messages, contacts, location data and saved passwords.

Financial theft looks like the primary motive. Chinese-language comments in the code and related infrastructure point to Chinese-speaking operators, but that does not establish nationality or any state link. DeadTag's operators remain unidentified.

Why it matters

For a company, the lesson is that a personal phone is now a credible source of corporate credentials even when the employee never opened an attachment or approved an install. In the case above, near-real-time alerting let the security team rotate the exposed credentials before stolen logins could be sold or used against company systems. Without that visibility, the first sign would have been a login from somewhere it should not be.

For website owners, the lesson is that every third-party script tag is an outstanding liability. A tag added by a long-gone marketing agency can be turned against your visitors years later, with no change to your own code.

What to do

iPhone users and mobile admins

• Install iOS updates promptly; the kits seen so far only work against older versions.
• High-risk individuals (executives, journalists, crypto holders) should consider Lockdown Mode, accepting its restrictions.
• If compromise is suspected, preserve logs before restarting the device, change exposed credentials, and move cryptocurrency to new wallets with fresh recovery phrases.

Website owners

• Inventory every external script your pages load and remove tags you no longer use.
• Check whether the domains behind the remaining tags are still owned by the vendor you expect.
• Enforce a Content Security Policy so a hijacked domain cannot serve arbitrary code.
• PrestaShop operators: audit module and theme folders for unfamiliar "analytics" components.

Stale third-party scripts and dangling domain references are exactly the kind of exposure that slips past routine reviews. Our Attack Surface Management service continuously maps what your sites load from the outside world and flags tags pointing at expired or re-registered domains, so a forgotten snippet does not become a spyware delivery channel for your customers.