iPhone attack through ads on Dutch news sites

In early November at least fourteen Dutch websites spread code through their ads that tried to take over iPhones. Anyone who had updated their device was, according to the publishers, expected to run no risk of a takeover: the exploited vulnerabilities had been fixed months earlier. Visit data could still go from every visitor to the attackers.

That is the lesson of this incident. As an organization you cannot stop a zero-day. A vulnerability whose patch is already available you can, and that is the minimum you have to arrange.

What happened

The attacker hacked none of the websites themselves, but the advertising system they share. Someone gained unauthorized access to its management system and added code to an ad tag. That system comes from an external supplier and is managed by a separate advertising service provider, according to the warning from VI.nl.

That tag runs on many sites at once, including VI, VoetbalPrimeur, Bright, Scientias, Autoblog, GeenStijl, Men’s Health and Runner’s World. Dutch public broadcaster NOS counts at least fourteen Dutch sites and one Belgian site. The publishers warned their visitors on Saturday evening, 14 November.

The unauthorized accounts were removed and existing sessions ended.

The code did two things. It forwarded visit data, such as IP address, pages visited and device information. That could affect every visitor, also with an updated iPhone or another device. On top of that, it tried to exploit vulnerabilities in iOS to get to passwords, messages, photos, contacts and crypto wallets. The risk applied to a visit to the site, whatever the browser.

Whether devices were actually taken over has not been established yet. It is confirmed that visit data was sent to the attackers. The investigation is ongoing.

Who was at risk

As far as investigated, only iPhones with an outdated iOS version were vulnerable to the takeover. The patches had existed for almost eight to almost eleven months when the attack began.

These are the versions the publishers and Security.NL name for this attack. For iOS 26 they give no minor version. Apple advises the latest iOS version.

For Android devices, iPads and computers the publishers found no comparable attack, but visit data from those devices may have been forwarded too. Apple already wrote in April 2026 in a warning of its own that devices with updated software were not vulnerable to the web attacks reported at that time.

You cannot stop zero-days, but you can stop known vulnerabilities

Which exploit kit was used here has not been confirmed. Security.NL mentions Coruna and DarkSword.

More is known about DarkSword. Google described it in March 2026 as a chain of six vulnerabilities for iOS 18.4 up to and including 18.7, used since November 2025 by, among others, a vendor of surveillance software and a suspected Russian espionage group. For part of those vulnerabilities no patch existed yet at the time.

Then what happens more often, happened. Apple fixed the vulnerabilities, the kit leaked and criminals took it over. About three quarters of the detections are criminals who are after credentials and crypto, a report by iVerify shows.

An attack of yesterday, meant for a handful of targets, is today a tool that can run through an ad on a football site. What stands in between is mainly an update.

Roughly:

• Zero-day: no patch yet. Rare, expensive and mostly used against chosen targets. Detection, segmentation and limited permissions help here.
• Known vulnerability with a patch: cheap, automated and used at scale. What helps here is mainly updating.

Whoever does not patch is vulnerable to every attacker with a download link. Whoever does patch is, for this kind of attack, left mainly with the attackers who can pay for a zero-day.

For administrators: do not make updating a choice

A user who taps “later” is not a patch policy. In a managed environment you enforce updates and check that they arrived.

• Enforce iOS updates with a deadline. With update policies for iOS and iPadOS a device updates itself after a fixed period. That works from iOS 17, on devices enrolled with Device Enrollment or Automated Device Enrollment.
• Set a minimum OS version in your compliance policy. A device below it counts as noncompliant; with actions for noncompliance you decide what follows.
• Do not forget personal devices. With app protection policies you also require a minimum iOS version on unmanaged phones: Min OS version with the action Block access blocks access in apps with the Intune SDK.
• Phase out devices that no longer get updates. An iPhone that cannot go beyond iOS 15 or 16 depends on separate emergency patches. Intune itself supports only iOS/iPadOS 18 and later since late September 2026, also for app protection (What’s new in Intune).
• Measure it. What is actually on the devices says more than a policy on paper. Intune has reports on the update status of Apple devices from iOS 17. The OS version of each device is under Devices > All devices.

The same holds outside iOS: Windows, macOS, browsers, firmware and third-party applications. The attacker picks the part you forgot.

What to do now

Did you visit one of the sites between 1 and 3 November or on 11 November with an iPhone that was not updated? Then the publishers advise this:

1. Install the latest iOS version through Settings > General > Software Update.
2. Change the passwords that were on the device, starting with email, Apple Account and bank, preferably from another device. Turn on two-factor authentication where possible.
3. Do you use a crypto wallet on that device? Consider moving your funds to a new wallet with a new recovery phrase, created on a safe device.
4. Watch for misuse, such as suspicious sign-in notifications or unknown transactions. Also be alert to phishing that refers to this incident.

Unable to update? For the web attacks reported earlier, Apple advised considering Lockdown Mode.

For organizations:

1. Run a report today: which devices are below the latest version, and on older lines in any case below iOS 18.7.3, 16.7.15 or 15.8.7?
2. Set a deadline on updates and a minimum version in your compliance policy.
3. Turn on automatic updates on everything you do not manage centrally.