[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhFKKvlxwWWw2xwwp0_Rp73BkO4tberE6Df3R9V0s8UM":3},{"article":4,"iocs":49,"watch_terms":58,"solutions":59,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"7c29e54a-b48b-4e0f-ac9e-b1507c432b35","An Instagram ad was all it took: Leaked exploit kits are hitting employees’ iPhones","an-instagram-ad-was-all-it-took-leaked-exploit-kits-are-hitting-employees-iphone-1ba231","Criminals are using leaked exploit kits to break into vulnerable iPhones, according to iVerify’s 2026 Advanced Mobile Threat Report. Attacks delivered through ads and compromised websites have reached employees who use phones for work. DarkSword chains together several software flaws to compromise iPhones. Researchers disclosed the toolkit in March 2026, and a newer version appeared on GitHub within a week, giving criminal groups code they could adapt. Another toolkit, Coruna, was served from websites posing … More → The post An Instagram ad was all it took: Leaked exploit kits are hitting employees’ iPhones appeared first on Help Net Security.","Criminals are leveraging leaked exploit kits, DarkSword and Coruna, to compromise iPhones, with attacks originating from Instagram ads and compromised websites. These toolkits chain together software flaws to steal cryptocurrency and extract sensitive information like passwords and session tokens from the iPhone's Keychain, potentially leading to larger corporate breaches if employees use personal devices for work. Evidence of these attacks can disappear quickly with a reboot or software update.","Leaked exploit kits DarkSword and Coruna are targeting iPhones via ads and compromised websites.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F11\u002Fiverify-iphone-exploit-kit-attacks-report\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2024\u002F08\u002F29142457\u002Fandroid-iphone.png","2026-11-11T05:00:34+00:00","2026-11-11T06:00:25.356545+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"iPhone","product",{"name":21,"type":22},"Instagram","vendor",{"name":24,"type":25},"Scattered Spider","threat_actor",{"name":27,"type":25},"ShinyHunters",{"name":29,"type":30},"exploit kit","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,44],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,53,55],{"type":35,"value":51,"context":52},"DarkSword","Exploit kit used to compromise iPhones.",{"type":35,"value":54,"context":52},"Coruna",{"type":35,"value":56,"context":57},"DeadTag","Traffic-selling operation that deployed DarkSword and Coruna.",[21,18],{"controls":60,"vendors":137},[61,90,108],{"slug":62,"name":63,"problem":64,"products":65},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":91,"name":92,"problem":93,"products":94},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[95,103],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":104,"product_name":105,"url":106,"description":107},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":109,"name":110,"problem":111,"products":112},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[113,121,129],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",[138],{"slug":139,"name":140,"logo_path":141,"roles":142},"apple","Apple","\u002Fvendor-logos\u002Fapple.png",[143],"affected",{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":154},"leaked-exploit-kits-targeting-employee-iphones-via-instagram-ads","Leaked Exploit Kits Targeting Employee iPhones via Instagram Ads","Criminals are weaponizing leaked exploit toolkits (DarkSword and Coruna) to compromise employee iPhones through malicious Instagram ads and compromised websites, chaining software vulnerabilities to steal cryptocurrency and extract passwords and session tokens from Apple's Keychain. The core problem is twofold: employees lack awareness of mobile-borne threats from everyday social media use, and organizations fail to enforce patching and security baselines on personal devices that access corporate resources. Because stolen session tokens can bypass multi-factor authentication and unlock corporate systems, a single compromised personal phone can serve as the entry point for a much larger breach. The ephemeral nature of the attack evidence — erased by a reboot or update — makes detection and forensic investigation extremely difficult.",[149,150,151,152,153],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(g)","MITRE ATT&CK T1539: Steal Web Session Cookie",{"NIS2 Article 21(2)(g)":155,"NIST SP 800-53 SI-2: Flaw Remediation":156,"MITRE ATT&CK T1539: Steal Web Session Cookie":157,"CIS Control 7: Continuous Vulnerability Management":158,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":159},"This point mandates basic cyber hygiene and training, which would have equipped employees to recognize that clicking Instagram ads on work-connected devices poses a significant threat vector.","SI-2 requires organizations to identify, report, and correct information system flaws on a defined timeline, which directly applies to ensuring mobile devices are patched before known exploits can be weaponized against them.","The exploit kits specifically targeted Keychain session tokens — a textbook example of this technique — meaning detection controls mapped to T1539 would have flagged or limited the credential theft.","This control requires ensuring software and OS patches are applied promptly; had employees' iPhones been running current iOS versions, the chained vulnerabilities used by DarkSword and Coruna may have been unavailable to attackers.","This control requires enforcing secure, up-to-date configurations on all devices — including mobile phones — that access enterprise resources, which would have reduced the attack surface exploited by the leaked toolkits."]