A newly documented malvertising campaign shows that scrolling through Instagram can be enough to get an iPhone infected with commercial-grade spyware. Security researchers at iVerify, working with ad-fraud detection firm Report URI, say they caught the infection happening in real time on an employee’s device at a client organization — triggered by nothing more than a World Cup-themed advertisement loading in the feed.

A “Half-Click” Attack Hiding in Plain Sight

Unlike a typical phishing lure, this attack didn’t ask the victim to download anything, install an app, or even tap the ad. The malicious creative simply rendered on screen and quietly delivered a variant of spyware the researchers call DarkSword P7. The team describes this style of attack as “half-click”: a person still has to be browsing a webpage or social app for the infection to trigger, but from that point on, no further interaction is needed.

That distinction matters for defenders. It means the threat isn’t an invisible, always-on exploit that can reach a phone sitting idle in someone’s pocket — it still depends on ad networks delivering malicious creative to an active session. But it also means none of the usual advice about “don’t click suspicious links” would have stopped this particular victim, who was simply using Instagram as normal.

Two Exploit Kits, One Shared Goal: Data and Crypto

The investigation identified two distinct iOS exploit kits circulating through this ad-fraud infrastructure: DarkSword and a second kit called Coruna. Both are designed to harvest sensitive material once they land on a vulnerable device, including:

• Keychain-stored passwords and saved login credentials
• Device identifiers and configuration details
• Messages, contacts, and location data
• Cryptocurrency wallet data from apps including Binance, Coinbase Wallet, OKX, Bitget, Trust Wallet, Exodus, TronLink, and Bitpie

Researchers stress that both kits rely on exploiting outdated iOS software rather than some unpatched zero-day sitting in every modern iPhone. Devices running current security updates were not shown to be at risk in this investigation.

DeadTag: Recycling the Internet’s Forgotten Ad Scripts

Perhaps the more unsettling part of the research is a companion operation the investigators named DeadTag. Rather than compromising individual websites one at a time, the group behind DeadTag buys up expired domains that used to host analytics and advertising scripts. Because web developers rarely clean up old tracking code, thousands of still-live websites keep calling out to those abandoned domains — unaware that whoever now owns them can use that leftover connection to redirect visitors anywhere they like.

Report URI says it identified hundreds of these re-registered domains feeding into sites that together see an estimated 135 million visits a month. The researchers are careful to note that figure reflects potential exposure, not confirmed infections — most of that hijacked traffic is funneled toward ordinary scam pages, with only a targeted subset of iPhone visitors steered toward the spyware payload. The group was also found seeding DarkSword loaders inside hundreds of compromised PrestaShop online stores, some of which redirected to a convincing fake Polymarket prediction-market page.

How the Ad Slipped Past Moderation

Investigators have not pinned down exactly how the malicious Instagram ad made it past Meta’s review process. Possible explanations on the table include cloaked content that behaves differently for reviewers than for real users, abuse of third-party ad resellers, or a compromised advertising partner — but none of these has been confirmed. The researchers are explicit that this is a demonstrated delivery channel, not evidence of a specific platform vulnerability in Instagram itself.

What Organizations Should Do Now

Because a single compromised personal phone can hand attackers a path into corporate email, messaging, and single sign-on sessions, the researchers recommend a layered response:

• Install iOS updates as soon as they’re available — both exploit kits target older software versions
• Enable Lockdown Mode for executives, journalists, and other high-risk users, understanding the feature trades some convenience for hardened security
• Website owners should audit and remove unused third-party tags and enforce a strict Content Security Policy to prevent abandoned domains from being weaponized
• If compromise is suspected, preserve device logs before rebooting, rotate any exposed credentials, and move cryptocurrency funds to wallets with freshly generated recovery phrases

The case is a reminder that mobile threat exposure increasingly has little to do with user behavior and everything to do with the advertising and analytics supply chain sitting quietly behind the apps people use every day.