Criminal hackers are spreading iPhone spyware through online ads and ordinary websites, and an iPhone on an older version of iOS can be infected just by loading the page or scrolling past the ad. Security firms iVerify and Report URI revealed the attacks in joint research published on October 21 and 22, 2026.
In one case, iVerify found the spyware arriving through a World Cup-themed advertisement on Instagram. It infected an employee’s iPhone while they were simply scrolling their feed, without tapping anything.
The two tools behind the attacks are called Coruna and DarkSword. Both attack the phone’s web browser itself, so there is no link to press, no app to install and no warning on the screen.
Older iPhones running iOS 18.4 to 18.7 are the main target
The spyware only works on iPhones that have not been updated. According to Report URI, the attackers pick the tool based on the iPhone’s software version.
Coruna targets older iPhones running iOS 13 up to iOS 17.2.1. DarkSword targets iOS 18.4 up to iOS 18.7. Researchers found that the attackers have prepared for the newer iOS 26 and iOS 27 as well, but iVerify said their attempts so far mostly do not work.
That makes the fix simple for most people: install the latest iOS update.
Check your iPhone in one minute
Open Settings, tap General, then About, and look at “iOS Version”. If it starts with 13, 14, 15, 16, 17 or 18, your phone may be exposed.
To update, go to Settings, then General, then Software Update, and install whatever is offered. Turning on Automatic Updates on the same screen means future fixes arrive without you having to remember.
If your iPhone is too old to get newer updates, be extra careful about the websites you open on it, and avoid keeping banking or crypto apps on that phone.
Report URI also suggests turning on Lockdown Mode for anyone who could be a bigger target, such as people holding large amounts of cryptocurrency. You will find it under Settings, then Privacy & Security. It blocks this kind of browser attack but makes some apps and websites work differently.
Ads and forgotten website code carry the attack
Report URI found that one criminal group, which it named DeadTag, buys up old website addresses that once belonged to analytics and advertising companies that shut down. Thousands of websites still load small pieces of code from these addresses, often without the site owners knowing.
Once DeadTag owns an address, every website still using that old code starts sending visitors to the attackers. Report URI said it has found more than 660 such addresses, still built into thousands of websites that together get an estimated 135 million visits a month.
Most of this traffic is sold on to scam pages, such as fake prize offers, fake VPN pop-ups and betting sites. But iPhone visitors can be quietly sent to a fake page that installs the spyware.
iVerify said it is not clear how the bad ad got past Instagram owner Meta’s checks. It warned that any website or app that shows ads could carry a similar risk.
Crypto wallets are the main prize
The spyware is built to steal passwords saved on the iPhone and to empty cryptocurrency wallets. Apps named by the researchers include Binance, Coinbase Wallet, OKX, Bitget, Trust Wallet and Exodus. iVerify said the tools can also take location data, messages and contacts.
The researchers believe the group running the spyware is financially motivated and probably Chinese-speaking, based on notes in its code and the wallets it targets.
If you think your phone was hit, the researchers advise restarting it, changing the passwords saved on it, and moving any cryptocurrency to a brand-new wallet with a new recovery phrase.
