{
 "schema_version": "1.0",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "incident": {
  "id": "iphone-ads-and-hijacked-tags-spyware",
  "url": "https://patchgap.ai/incidents/iphone-ads-and-hijacked-tags-spyware/",
  "path": "/incidents/iphone-ads-and-hijacked-tags-spyware/",
  "json_url": "https://patchgap.ai/incidents/iphone-ads-and-hijacked-tags-spyware.json",
  "title": "iPhone: criminals are using bad ads and old website tags to attack iPhones that are not updated",
  "category": "phones",
  "platforms": [
   "ios"
  ],
  "products": [
   "iphone-ios"
  ],
  "status": "patched",
  "status_label": "Patched: update now",
  "severity": "high",
  "severity_source": "Rated by us as high. Researchers report real attacks. No official score.",
  "exploited_in_wild": "yes",
  "exploited_note": "Researchers at iVerify and Report URI say they saw real attacks. Apple has not commented on this report.",
  "exploited_source_url": "https://www.iverify.com/blog/blog-malvertising-coruna-darksword-iphone-exploits",
  "confidence": "unconfirmed",
  "confidence_note": "The attack report comes from security researchers, not Apple. Apple's page only tells us which iOS versions are the newest.",
  "first_reported": "2026-10-21",
  "updated_at": "2026-10-27",
  "cves": [],
  "summary": "Researchers say criminals are using bad ads and old, taken-over website pieces (called tags) to attack iPhones that are behind on updates. Just visiting a bad page on an out-of-date iPhone could install spying software that steals saved passwords and crypto wallet data. Phones that are up to date are said to be safe.",
  "am_i_affected": "You may be at risk if your iPhone or iPad has not been updated in a while. Go to Settings > General > About to see your iOS version, then Settings > General > Software Update.",
  "action": "Update your iPhone or iPad to the newest iOS",
  "affected": [
   {
    "product": "iphone-ios",
    "product_name": "iPhone and iPad (iOS)",
    "platform": "ios",
    "affected_versions": "iPhones and iPads that are behind on updates",
    "fixed_version": null,
    "fixed_min": null,
    "fix_note": "Install the newest iOS Apple offers for your phone. On Oct 26, 2026 these were iOS 27.2, 26.7.2 and 18.7.11 (older iPhones).",
    "fixed_source_urls": [
     "https://support.apple.com/en-us/100100"
    ],
    "check": {
     "menu_path": "On your iPhone: Settings > General > About to see your version. Settings > General > Software Update to update.",
     "command": null,
     "shell": null,
     "read_only": null
    },
    "official_download": "https://support.apple.com/en-us/100100"
   }
  ],
  "fix_steps": [
   "Open Settings > General > Software Update.",
   "Tap Update Now and let it finish.",
   "Turn on Automatic Updates on the same screen.",
   "If your phone cannot update, think about replacing it. Do not use it for banking."
  ],
  "official_patch_links": [
   {
    "label": "Apple: security releases",
    "url": "https://support.apple.com/en-us/100100"
   }
  ],
  "extra_checks": [],
  "sources": [
   {
    "url": "https://support.apple.com/en-us/100100",
    "title": "Apple: security releases (newest iOS versions as of Oct 26, 2026)",
    "date": "2026-10-26",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://www.iverify.com/blog/blog-malvertising-coruna-darksword-iphone-exploits",
    "title": "iVerify and Report URI: infected ads and expired tags deliver iPhone spyware",
    "date": "2026-10-21",
    "kind": "research",
    "official": false
   },
   {
    "url": "https://blog.report-uri.com/deadtag-how-forgotten-website-tags-became-a-delivery-network-for-iphone-spyware/",
    "title": "Report URI: DeadTag",
    "date": "2026-10-22",
    "kind": "research",
    "official": false
   }
  ]
 }
}