An Instagram ad was all it took: Leaked exploit kits are hitting employees’ iPhones

A credential leak at Instagram is now a trust-relationship problem between its systems and connected services, not just a contained internal issue.

Criminals are using leaked exploit kits to break into vulnerable iPhones, according to iVerify’s 2026 Advanced Mobile Threat Report.

Attacks delivered through ads and compromised websites have reached employees who use phones for work.

Researchers disclosed the toolkit in March 2026, and a newer version appeared on GitHub within a week, giving criminal groups code they could adapt.

DeadTag, a traffic-selling operation documented by Report URI researcher Scott Helme, acquired an expired domain once used for e-commerce analytics.

Some stores still referenced it in their website templates, so shoppers’ browsers fetched a script controlled by the new owner.

Anyone connected to Instagram through the compromised trust relationship is potentially affected, not just Instagram itself.

Another toolkit, Coruna, was served from websites posing as finance and cryptocurrency services.

A DarkSword variant began infecting an iPhone when an Instagram ad loaded while its user was scrolling.

A leaked key doesn't need an exploit to be dangerous -- it just needs to still work before someone notices and revokes it.

Researchers attributed the incidents to separate actors and assessed that both sought to steal cryptocurrency.

DarkSword can extract passwords and other sign-in information from the iPhone’s Keychain.

The trust mechanism involved here is an OAuth or access token, which is what let access move between otherwise unrelated systems.

The same person later clicked a link that delivered a different version of the toolkit.

One destination posed as a cryptocurrency trading site and quietly loaded a hidden page that checked for Safari on iOS 18.4.0 through 18.7.2, then launched the DarkSword exploit chain on matching iPhones.

Instagram says the credential has been revoked, and no exploitation has been confirmed so far.

A separate group bought traffic from DeadTag and deployed DarkSword and Coruna.

A reboot or software update can remove the running malware and erase evidence that could help investigators reconstruct the attack.

If you have any integration or dependency involving Instagram, rotate any credentials shared with it as a precaution, even without confirmation you were directly affected.

Your own credential inventory is worth auditing for keys or tokens with broader access than they actually need -- the same blast-radius problem applies to anything your own organization leaks.

The conservative estimate for monitored consumer iOS devices was 1.07 spyware infections per 1,000 devices.