An Instagram ad was all it took: Leaked exploit kits are hitting employees’ iPhones

Criminals are weaponizing leaked exploit toolkits (DarkSword and Coruna) to compromise employee iPhones through malicious Instagram ads and compromised websites, chaining software vulnerabilities to steal cryptocurrency and extract passwords and session tokens from Apple's Keychain. The core problem is twofold: employees lack awareness of mobile-borne threats from everyday social media use, and organizations fail to enforce patching and security baselines on personal devices that access corporate resources. Because stolen session tokens can bypass multi-factor authentication and unlock corporate systems, a single compromised personal phone can serve as the entry point for a much larger breach. The ephemeral nature of the attack evidence — erased by a reboot or update — makes detection and forensic investigation extremely difficult.