Leaked exploit kits are actively breaking into vulnerable iPhones, according to iVerify’s 2026 Advanced Mobile Threat Report published on November 11, 2026. Attackers are...
Criminals are leveraging leaked exploit kits, including DarkSword and Coruna, delivered via Instagram ads and compromised websites to target vulnerable iPhones used by employees.
The 2026 Advanced Mobile Threat Report Findings
Leaked exploit kits are actively breaking into vulnerable iPhones, according to iVerify’s 2026 Advanced Mobile Threat Report published on November 11, 2026. Attackers are delivering these exploits through online advertisements, such as Instagram ads, and compromised websites. These campaigns have successfully reached employees who use their mobile phones for work purposes.
The threats rely on sophisticated tooling that has leaked into the wild. Specifically, the DarkSword toolkit chains together several software flaws to compromise iPhones. Security researchers originally disclosed this toolkit in March 2026. Within a week of that disclosure, a newer version appeared on GitHub, supplying criminal groups with adaptable code. Another toolkit named Coruna was also served from websites posing as legitimate destinations.
Confirmed Vulnerabilities and Tooling
The use of real-world exploit kits against enterprise and consumer devices is detailed directly in the threat documentation.
| Exploit Toolkit | Disclosed / Observed Timeline | Delivery Method | Primary Target |
|---|---|---|---|
| DarkSword | Disclosed March 2026; updated on GitHub within a week | Instagram ads and compromised websites | Vulnerable iPhones used by employees |
| Coruna | Not in the sources | Websites posing as legitimate destinations | Vulnerable iPhones |
Official confirmation from authoritative specifications and documentation verifies that these campaigns are active. Tech consumers, gadget buyers, and developers face ongoing risks from these adapted toolkits. Pricing details, software versions, and specific corporate actions beyond the threat report findings are not in the sources.
What to Watch or Do Next
Tech consumers, gadget buyers, and developers should monitor for updates regarding mobile device security and malicious ad delivery mechanisms. Because attacks are arriving through routine channels like social media advertisements and compromised web pages, users relying on mobile devices for work should exercise heightened caution. Further technical specifications, exact version numbers, and pricing details remain unconfirmed.
Frequently Asked Questions
Q1: What exploit kits are criminals using to target iPhones?
Criminals are using leaked toolkits named DarkSword and Coruna to break into vulnerable iPhones.
Q2: How are these exploit kits being delivered to victims?
Attacks are delivered through Instagram ads, compromised websites, and sites posing as legitimate destinations.