iPhone Exploit Kits: Leaked DarkSword Code Reached an Employee's iPhone Through an Instagram Ad, and How to Lock Down Work Phones

Criminals are now using leaked iPhone exploit kits, tools first built for state-backed hackers and surveillance firms, to break into ordinary employees' iPhones through online ads and hacked websites. If your staff read work email or sign in to company systems on an iPhone that is behind on updates, an ad loading in a social media feed may be enough to hand an attacker their saved passwords.

What happened with the leaked iPhone exploit kits

On November 10, 2026, mobile security company iVerify published its 2026 Advanced Mobile Threat Report. Its main finding is that advanced phone attacks are no longer aimed only at diplomats and executives. According to the report, "75% of detections were criminal, not state-sponsored", mostly people after credentials and cryptocurrency. It also says that "in every enterprise case we confirmed, the person affected was an employee below managing director level."

Two exploit kits are at the centre of this: DarkSword and Coruna. Both were exposed in March 2026. Google's Threat Intelligence Group published its DarkSword analysis on March 18, 2026. It describes a chain of six vulnerabilities that took over iPhones running iOS 18.4 through 18.7 when the user opened a booby-trapped web page in Safari. Google linked that early use to state-backed groups and commercial surveillance vendors, with targets in Saudi Arabia, Turkey, Malaysia and Ukraine. iVerify's report says the leak of DarkSword on GitHub "put government-grade iOS exploits in criminal hands", and criminal groups have since built new variants, including one called P7 that iVerify found on a financial institution employee's phone.

We covered the earlier state-linked attacks in Zero-Click Exploit on iOS and Android. This post covers what happened next: the same kind of tool in criminal hands, reaching ordinary staff.

The Instagram ad

In a joint write-up with Report URI, iVerify says it caught the P7 variant of DarkSword being delivered through a malicious World Cup-themed ad on Instagram. The ad began infecting an employee's iPhone while they were scrolling their feed. No tap was needed. iVerify calls these "half-click" attacks because the exploit starts as soon as the ad loads. Help Net Security reports that the same person later clicked a link that delivered a different version of the toolkit, and that researchers attributed the two incidents to separate actors who both appeared to be after cryptocurrency.

iVerify does not treat this as a problem with one app. Its view is that "any ad-supported platform may carry similar risk", because ads and the code that serves them reach phones through almost every site and app.

Dead website tags

The same write-up describes a second route that affects websites as much as phones. Many sites still carry tracking or analytics tags for services that shut down long ago. When those services' domains expired, an operation the researchers call DeadTag re-registered them. Every site still loading the old tag then loaded whatever the new owner served. Some visitors were passed through traffic brokers to pages that launched Coruna or DarkSword, including a fake Polymarket page. iVerify says it has found hundreds of these re-registered domains, still embedded on thousands of websites, and that the operation "sees 135 million visits a month to sites that can serve Coruna or DarkSword spyware."

What is confirmed and what is not

Why this matters for a company network

A phone is where many employees keep company email, chat, sign-in apps and saved passwords. Help Net Security reports that DarkSword can pull passwords and sign-in details from the iPhone Keychain, and iVerify's advice to anyone infected includes changing their Keychain passwords. If that phone holds logins for your email, file sharing or remote access, an attacker can sign in as a real employee with real credentials. Your firewall and email filter never see the break-in, because it happened on a phone browsing an ad.

Personal phones used for work (BYOD) are the weak point. They are the ones most likely to be a version or two behind, and the company often has no view of them. You also cannot wait for Apple to raise the alarm: iVerify's report says attackers clean up aggressively and traces fade from devices quickly, so evidence may be gone before anyone looks.

The dead-tag route is a website problem too. If your site still loads a script from a service you stopped using, whoever owns that domain next decides what your visitors run. That is the same kind of hidden exposure we described in Your Website Is Live. Can Anyone Find It, and Is It Locked?.

What to do this week

For the details of this week's iPhone update, see our post on iOS 27.2.1. If your staff also carry Android phones, our post on Mirax Android RAT covers locking those down.

iPhone exploit kit questions people are asking

Can an iPhone be hacked just by seeing an ad?

An out-of-date one can. iVerify recorded a DarkSword variant starting to infect an iPhone when a malicious Instagram ad loaded while the user scrolled. The kits target older iOS versions that Apple has already fixed.

What is DarkSword?

DarkSword is an iPhone exploit kit that chains six iOS flaws to take over a phone through Safari. Google documented it in March 2026. iVerify says it later leaked on GitHub and criminals now use modified versions.

Is my iPhone safe if it is fully updated?

Google says all six DarkSword flaws were fixed by iOS 26.3. iVerify says attempts to rework the kits for iOS 26 and 27 mostly do not work yet. Updating is the main protection.

Will Apple warn me if my iPhone is hacked?

Do not count on it. iVerify says that, to its knowledge, no device it confirmed as infected with DarkSword or Coruna received an Apple threat notification.

Are personal phones used for work a risk to the company?

Yes. If a personal phone holds company email or saved work passwords, a break-in on that phone can become a break-in on company systems. Set a minimum iOS version for any phone that reaches company data.

What should a website owner do about dead tags?

Remove scripts for services you no longer use, keep a list of every outside domain your pages load, and use a Content Security Policy so the browser refuses anything else.

The bigger lesson

Tools built for spies do not stay with spies. Once an exploit kit leaks, the people using it are criminals working at volume, and the targets are whoever is behind on updates. For a business, that means the phones and the website you do not watch are the ones that decide your risk. Keeping every device current and every script on your site accounted for is ordinary upkeep, and it is the upkeep that closes these doors.

See how we approach security hardening, or request a quote for a review of your devices and website.

Get security alerts like this by email, with our free checklist, at /security-alerts.

Sources: iVerify 2026 Advanced Mobile Threat Report; iVerify and Report URI: Dead Domains, Live Exploits; Google Threat Intelligence Group: DarkSword; Apple security releases; Help Net Security.