# Coruna exploit kit reached iPhones via a hijacked ad tag on at least twelve Dutch websites

- Published: 2026-11-15 14:16 UTC
- Section: Digital & Computing › Data security
- Tags: Coruna exploit kit, iPhone vulnerabilities, compromised ad system, PXR NextDay, VI.nl, GeenStijl, Dutch websites, ad tag manipulation, DarkSword
- URL: https://realtech.media/news/rt-8a06a1c2a369dabead8903c1_coruna_exploit_kit/

**Via a manipulated ad tag, code that tried to exploit iPhone vulnerabilities without user interaction ran on Dutch sites; the ad network reports three unauthorized accesses.**

![Coruna exploit kit reached iPhones via a hijacked ad tag on at least twelve Dutch websites](https://realtech.media/media/2026/11/d868770d31b459e0.webp)
*ad-hoc-news.de*

Malicious code delivered through compromised advertising systems reached numerous high-traffic Dutch websites and tried to exploit vulnerabilities on iPhones without any user action, ad-hoc-news.de reports, citing trade media coverage of 15 November 2026. Affected sites included VI.nl, Bright.nl, Autoblog and GeenStijl. The software involved was the exploit kit Coruna. [1]

According to VI.nl, an unauthorized third party manipulated an ad tag in the ad management system. No interaction was needed: visitors did not have to click any banner for the code to run on their devices. [1]

## Timeline of the unauthorized access

According to the ad network PXR NextDay, the unauthorized access occurred in three periods. The first ran from 1 November to 3 November Dutch time, and the iPhone-specific code was active from 1 November. The second window fell on 3 November. The third was a short interval on 11 November; its content has not been established. [1]

PXR NextDay says it serves ads to about 150 websites with roughly 12 million unique visitors per month and about 800 million ad impressions. At least twelve Dutch sites warned their users, including VI, VoetbalPrimeur, VoetbalNieuws, Bright, Scientias, Autoblog, Men's Health, Women's Health, Runner's World, Bicycling, GeenStijl and Autoreview.nl. De Dagelijkse Standaard also uses the NextDay Advertising system; whether its visitors were actually compromised was not yet clear. [1]

## Data at risk and remediation

Affected portals, including VI.nl, Bright.nl, VoetbalNieuws.nl, GeenStijl.nl and De Dagelijkse Standaard, said the code collected metadata and sent it to an attacker's server: IP addresses, pages viewed, referring addresses, screen dimensions, language settings and operating system information. The browser used did not matter. No comparable attacks on the system were registered on Android devices, iPads or conventional computers, although basic technical data may have been collected. [1]

If an iPhone was successfully infected, VI.nl said, there was a risk of broad access to confidential information: passwords, app credentials, crypto wallet keys, text messages, image files and contact lists. Google had already warned of the Coruna and DarkSword exploit kits in early 2026. [1]

GeenStijl.nl stopped displaying ads on 3 November. On 11 November the vulnerability was closed, the malicious code removed and the unauthorized user accounts deleted. Scientias.nl and VI.nl also reported that the code had been removed and the fault in the ad system fixed. According to VI.nl, whether private data was actually stolen is unconfirmed, and investigations continue. Visitors who opened VI.nl from 1 to 3 November and on 11 November 2026 were asked to follow protective steps from a staged plan the site provided. [1]

## Sources

1. [ad-hoc-news.de](https://www.ad-hoc-news.de/wissenschaft/iphone-angriffe-ueber-werbung-coruna-code-erreicht-mindestens-zwoelf-websites/70516769)

---

Source: RealTech, realtech.media — https://realtech.media/news/rt-8a06a1c2a369dabead8903c1_coruna_exploit_kit/