Instagram ads delivered iPhone exploits, but no logs show which ad or click.

Criminals used leaked iPhone exploit kits like DarkSword and Coruna to compromise work devices through Instagram ads and malicious websites, according to iVerify's 2026 report. The toolkits chain together software flaws and were publicly leaked on GitHub shortly after disclosure, enabling widespread attacks on employees using iPhones for work.

The source does not say how firms would prove which ad, click or malicious site actually delivered the exploit to a given device. Logs of ad impressions, browser history and network requests can be edited by whoever keeps them.

A digital witness would show the exact ad served, the click timestamp and the payload delivered, readable years later when the firm discovers the breach. For an enterprise managing hundreds of work devices, that record could settle disputes over whose ad network or site delivered the compromise, and whether the employee followed policy. Without it, the firm knows devices were hit but cannot prove how or when.