Researchers say criminals are using bad ads and old, taken-over website pieces (called tags) to attack iPhones that are behind on updates. Just visiting a bad page on an out-of-date iPhone could install spying software that steals saved passwords and crypto wallet data. Phones that are up to date are said to be safe.
- Status
- Patched: update now
- Being attacked?
- Yes[2]
- Severity
- High
- Updated
Researchers at iVerify and Report URI say they saw real attacks. Apple has not commented on this report. Severity: Rated by us as high. Researchers report real attacks. No official score. First reported .
Am I affected?
You may be at risk if your iPhone or iPad has not been updated in a while. Go to Settings > General > About to see your iOS version, then Settings > General > Software Update.
| App | Device | Affected | Fixed in |
|---|---|---|---|
| iPhone and iPad (iOS) | iPhone / iPad | iPhones and iPads that are behind on updates | Install the newest iOS Apple offers for your phone. On Oct 26, 2026 these were iOS 27.2, 26.7.2 and 18.7.11 (older iPhones).[1] |
How to check your version
These checks only look. They do not change anything on your computer.
iPhone and iPad (iOS) on iPhone / iPad
Easy way: On your iPhone: Settings > General > About to see your version. Settings > General > Software Update to update.
How to fix it
- Open Settings > General > Software Update.
- Tap Update Now and let it finish.
- Turn on Automatic Updates on the same screen.
- If your phone cannot update, think about replacing it. Do not use it for banking.
More on each app: Is my iPhone up to date?
Official links
Check before installing, and only use these official links or the app's own update button.
For AI agents
This page as data: /incidents/iphone-ads-and-hijacked-tags-spyware.json. All problems: /feed.json. Use read-only checks only, and ask before installing anything.
Tracking numbers (CVE): None
Sources
- MakerApple: security releases (newest iOS versions as of Oct 26, 2026) (Oct 26, 2026)
- ResearcheriVerify and Report URI: infected ads and expired tags deliver iPhone spyware (Oct 21, 2026)
- ResearcherReport URI: DeadTag (Oct 22, 2026)
"Maker", "CISA", "NVD", "GitHub advisory" and "Official notice" are official sources. "Researcher" and "News" are extra context.