Attackers have devised a new method to infect iPhones with spyware simply through malicious Instagram advertisements—users don’t even need to tap or install anything. The campaign, discovered in late October 2026, made use of a World Cup-themed ad to deploy the P7 version of DarkSword, a potent iOS exploit kit capable of harvesting sensitive information silently. It was first revealed when researchers traced it while investigating an employee’s phone at a company client.
How the Attack Worked
Dubbed a “half-click” attack, the exploit activates merely by loading the Instagram feed. Once the malicious ad appears, vulnerable devices are automatically attacked—even if the user does not click. The architecture uses DarkSword and Coruna, two iOS exploit kits that break the typical browser sandbox through combinations of system and browser flaws.
These attacks are not fully zero-click—they require the user to be browsing Instagram or another website—but stop short of any interactive step such as tapping a link or downloading an app. Crucially, researchers note that the exploit targets outdated versions of iOS, with newer releases allegedly not susceptible to the identified variants.
Related Operation: DeadTag
A connected effort called DeadTag expands the reach of these spyware campaigns by exploiting old, forgotten domains used for advertising and analytics. By re-registering these abandoned domains, attackers gain control of scripts on thousands of sites that still load them. This allows redirection to malicious payloads for a slice of traffic—particularly for iPhone users who meet certain targeting conditions.
Researchers estimate that roughly 135 million site visits per month are exposed—even if only a small share trigger actual infections. Among these exploit targets are cryptocurrency wallets (like Coinbase Wallet, Binance, Trust Wallet and others), device keychains, messages, location data, contacts, and login credentials.
What Can Be Done
User defenses include installing the latest iOS updates immediately and enabling Lockdown Mode if at risk. For site owners, auditing and removing unused third-party tags, monitoring external scripts, and establishing a strict Content Security Policy are essential.
In cases of suspected compromise, experts recommend preserving system logs before rebooting, changing exposed credentials, and—if cryptocurrency wallets are involved—creating new recovery phrases.
While this incident does not prove a flaw in Instagram itself, it does showcase how advertisements, ad delivery systems, and let forgotten scripts can be weaponized. Because the drivers are out-of-date iOS software and weak external dependencies, the risk is mostly for those who have not kept their devices current—and for enterprise environments where personal devices touch work networks. Watching how Meta, Apple, and ad tech vendors respond to tighten vetting, advertiser accountability, and domain hygiene will be pivotal going forward.
This development underscores a larger trend: attackers are increasingly leveraging digital advertising and overlooked infrastructure as stealthy delivery channels for serious threats. These “half-click” and legacy domain exploits highlight the intersection of advertisement ecosystems and device security. Patching old software, cleaning up advertising dependencies, and setting up stronger policy guards aren’t just hygiene—they’re now frontline defense. Keep a close eye on how iOS updates the affected vulnerabilities and how ad platforms step up to curb similar abuses.
