Malicious ads and expired web tags delivered DarkSword to iPhones

What happened

iVerify found that a World Cup-themed Instagram ad delivered the DarkSword P7 variant to an employee's iPhone. Separately, Report URI found that expired analytics tags, still embedded in many websites, had been redirected to send iPhone visitors to Coruna and DarkSword attack pages.

No app had to be installed: an ad or an ordinary website led the iPhone to the exploit page.

What was found

DarkSword loaders also turned up on hundreds of PrestaShop online stores. Domains linked to the operation draw about 135 million visits a month, a traffic figure rather than a count of victims. Who is behind it is unknown: the researchers say the actors appear to be Chinese-speaking but call that inconclusive.

Data at risk

• Keychain data
• Crypto wallet data
• Seed phrases

What you should do

1. 1Update to the latest iOS; all six flaws DarkSword uses were fixed in iOS 26.3.
2. 2Do not tap limited-time promotion or giveaway ads on social platforms.
3. 3Do not keep crypto wallet seed phrases on your iPhone; use a hardware wallet for large holdings.