EN PT-BR
← Voltar ao feed
high financial cryptocurrency advertising

Coruna iOS exploit kit delivered via malvertising steals crypto seed phrases, ADEX reports

1 fonte(s) · 1 atualização(ões) · publicado 29/10/2026 12:09 · coletado há 3 dias

Anti-fraud firm ADEX reports in its State of Ad Fraud 2026: ADEX Trust & Safety Report that malicious iOS scripts caused roughly one in five ad platform account suspensions in Q3 2026. A detailed case involves the Coruna exploit kit, distributed through roughly 50 advertiser accounts sharing a common back-end behind varied landing pages. The kit fingerprints iOS devices, evades moderators and crawlers, then delivers a version-specific exploit chain disguised as a .min.js file to steal wallet recovery seed phrases from blockchain and financial apps. Exploit chains cover iOS 13.0 through 17.2.1, leaving older unpatched hardware such as the first-generation iPhone SE most exposed. ADEX also found AI indicators in 52% of distinct fraud schemes observed and forecasts 2027 attacks on AI browsing/shopping agents via prompt injection on landing pages.

Detalhes técnicos

  • Stage 1 – Fingerprinting: a hidden iframe verifies a genuine iPhone/iPad and identifies model and iOS version.
  • Stage 2 – Reviewer evasion: bots, crawlers, suspicious IPs, private browsing and devices in Apple Lockdown Mode receive a benign page.
  • Stage 3 – Tailored payload: an exploit chain matched to the exact iOS version and chip, served as an ordinary-looking .min.js file.
  • Stage 4 – Theft: final implant targets blockchain and financial apps searching for seed phrases.
  • Forecast injection vectors against AI agents: invisible text (white-on-white, zero-size fonts, CSS-hidden blocks), alt text/meta tags/HTML comments/structured data, text embedded in images, fake assistant notes in reviews or FAQs, and agent cloaking.

Remediação

  • Update iOS devices; hardware that cannot run current iOS remains exposed.
  • Judge ad campaigns by the final click destination across devices and countries; treat landing pages whose only exit is a messenger link as high risk.
  • Verify declared agent identities (e.g. cryptographically signed agent requests) and check agent behaviour matches its stated task.
  • Audit owned pages for hidden text, metadata and structured data aimed at machines.

Linha do tempo

  1. gbhackers.com ↗ · pub. 29/10/2026 12:09 · coletado 29/10 13:00 primeiro registro

    Coruna iOS exploit kit delivered via malvertising steals crypto seed phrases, ADEX reports

    ler a análise desta fonte

    Anti-fraud firm ADEX reports in its State of Ad Fraud 2026: ADEX Trust & Safety Report that malicious iOS scripts caused roughly one in five ad platform account suspensions in Q3 2026. A detailed case involves the Coruna exploit kit, distributed through roughly 50 advertiser accounts sharing a common back-end behind varied landing pages. The kit fingerprints iOS devices, evades moderators and crawlers, then delivers a version-specific exploit chain disguised as a .min.js file to steal wallet recovery seed phrases from blockchain and financial apps. Exploit chains cover iOS 13.0 through 17.2.1, leaving older unpatched hardware such as the first-generation iPhone SE most exposed. ADEX also found AI indicators in 52% of distinct fraud schemes observed and forecasts 2027 attacks on AI browsing/shopping agents via prompt injection on landing pages.

    Technical Details

    • Stage 1 – Fingerprinting: a hidden iframe verifies a genuine iPhone/iPad and identifies model and iOS version.
    • Stage 2 – Reviewer evasion: bots, crawlers, suspicious IPs, private browsing and devices in Apple Lockdown Mode receive a benign page.
    • Stage 3 – Tailored payload: an exploit chain matched to the exact iOS version and chip, served as an ordinary-looking .min.js file.
    • Stage 4 – Theft: final implant targets blockchain and financial apps searching for seed phrases.
    • Forecast injection vectors against AI agents: invisible text (white-on-white, zero-size fonts, CSS-hidden blocks), alt text/meta tags/HTML comments/structured data, text embedded in images, fake assistant notes in reviews or FAQs, and agent cloaking.

    Remediation

    • Update iOS devices; hardware that cannot run current iOS remains exposed.
    • Judge ad campaigns by the final click destination across devices and countries; treat landing pages whose only exit is a messenger link as high risk.
    • Verify declared agent identities (e.g. cryptographically signed agent requests) and check agent behaviour matches its stated task.
    • Audit owned pages for hidden text, metadata and structured data aimed at machines.