{"id":"CMP-202611-2tixcu","kind":"campaign","aliases":[],"related":[],"title":"Dutch news sites (Bright.nl, VI.nl, GeenStijl, Autoblog) served the Coruna iPhone exploit kit through hacked ads, stealing visitor data and targeting outdated iOS","description":null,"summary":"Attackers hacked the ad management system of an external supplier run by ad provider Next Day Media (per GeenStijl) and added malicious code to an ad tag shown on Dutch sites including Bright.nl, VI.nl, Autoblog and GeenStijl; the total number of sites is unknown. Access happened 1-3 Nov 2026 and again on 11 Nov 2026 (effect of the 11 Nov change unknown). The code sent visitor data (IP address, pages visited, referrer, screen size, language, OS) to an attacker server, which is confirmed, and tried to exploit iPhones on iOS 18.7.2 and older and versions before 15.8.7 / 16.7.15 (GeenStijl names the Coruna iOS exploit kit). A successful exploit gives access to saved passwords, app logins, crypto wallet keys, messages, photos and contacts. Whether any iPhones were actually taken over is not yet established. The sites say the code is removed and the hole is fixed. Source: Tweakers, 15 Nov 2026.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-15T11:45:49+00:00","products":[{"name":"iOS","fixed":[],"vendor":"Apple","affected":"<=18.7.2, <15.8.7, <16.7.15"},{"name":"Next Day Media ad platform","fixed":[],"vendor":"Next Day Media"},{"name":"Bright.nl","note":"disclosed by the company","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"VI.nl","note":"disclosed by the company","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"GeenStijl","note":"disclosed by the company","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"iPhones that visited Bright.nl, VI.nl, Autoblog, GeenStijl or other Dutch sites carrying Next Day Media ads between 1 and 3 Nov or on/after 11 Nov 2026 while on iOS 18.7.2 or older (or older than 15.8.7 / 16.7.15 on legacy branches) are at risk. Attacker server, domains and other indicators are unknown so far. Sites that use Next Day Media ad tags: check the ad tag for injected code.","fix":"Update iPhones to the latest iOS (at least past 18.7.2, or 15.8.7 / 16.7.15 on older devices). If an outdated iPhone visited the affected sites, change passwords and app logins, and move crypto to a new wallet with a new recovery phrase. Consider Lockdown Mode for high-risk users. Publishers using Next Day Media should review their ad tags.","status":"open","published_at":null,"first_seen_at":"2026-11-15T11:45:49+00:00","triaged_at":"2026-11-15T11:45:49+00:00","updated_at":"2026-11-15T11:54:59+00:00","category":"vendor","confidence":null,"triage":{"cause":{"at":"2026-11-15T11:55:26Z","path":"third-party-breach","entry":"unknown","reason":"Attackers hacked the ad management system of an external supplier run by Next Day Media and injected malicious code into an ad tag shown on the Dutch sites, but the record does not say how they got into that system.","history":[{"at":"2026-11-15T11:50:14Z","path":"third-party-breach","entry":"unknown","confidence":0.6}],"confidence":0.85}},"analyst_status":"done","analyst_note":null,"search":"'-2':26A '-202611':25A '-3':88B '1':87B '11':94B,100B '15':189B '15.8.7':138B '16.7.15':139B '18.7.2':132B '2026':90B,96B,191B 'access':85B,151B 'actual':168B 'ad':16A,32A,44B,53B,66B 'add':61B 'address':110B 'app':155B 'attack':41B,120B 'autoblog':7A,75B 'bright.nl':4A,34A,73B 'campaign':37B 'chang':102B 'cmp':24A 'code':63B,105B,179B 'confirm':124B 'contact':163B 'coruna':10A,143B 'crypto':157B 'data':19A,108B 'day':30A,56B 'dutch':1A,70B 'earli':39B 'early-warn':38B 'effect':97B 'establish':174B 'exploit':12A,128B,145B,149B 'extern':49B 'fix':186B 'geenstijl':6A,36A,59B,77B,140B 'give':150B 'hack':15A,42B 'happen':86B 'hole':184B 'includ':72B 'io':23A,131B,144B 'ios':28A 'ip':109B 'iphon':11A,129B,166B 'key':159B 'kit':13A,146B 'languag':116B 'login':156B 'malici':62B 'manag':45B 'media':31A,57B 'messag':160B 'name':141B 'news':2A 'next':29A,55B 'nov':89B,95B,101B,190B 'number':80B 'older':134B 'os':117B 'outdat':22A 'page':111B 'password':154B 'per':58B 'photo':161B 'platform':33A 'provid':54B 'referr':113B 'remov':181B 'run':51B 'save':153B 'say':177B 'screen':114B 'sent':106B 'serv':8A 'server':121B 'shown':68B 'site':3A,71B,82B,176B 'size':115B 'sourc':187B 'steal':17A 'success':148B 'supplier':50B 'system':46B 'tag':67B 'taken':169B 'target':21A 'tixcu':27A 'total':79B 'tri':126B 'tweaker':188B 'unknown':84B,103B 'version':136B 'vi.nl':5A,35A,74B 'visit':112B 'visitor':18A,107B 'wallet':158B 'warn':40B 'whether':164B 'yet':173B","nicknames":["Coruna","Next Day Media ad compromise"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["brightnl","coruna","daymediaadplatform","geenstijl","ios","nextdaymediaadcompromise","nextdaymediaadplatform","vinl"],"ptokens":["ad","bright","day","geenstijl","ios","media","next","nl","platform","vi"],"labels":["campaign","earlywarning","high","vendor"],"campaign_type":"breach","search_a":"'-2':26A '-202611':25A 'ad':16A,32A 'autoblog':7A 'bright.nl':4A,34A 'cmp':24A 'coruna':10A 'data':19A 'day':30A 'dutch':1A 'exploit':12A 'geenstijl':6A,36A 'hack':15A 'io':23A 'ios':28A 'iphon':11A 'kit':13A 'media':31A 'news':2A 'next':29A 'outdat':22A 'platform':33A 'serv':8A 'site':3A 'steal':17A 'target':21A 'tixcu':27A 'vi.nl':5A,35A 'visitor':18A","search_b":"'-3':88B '1':87B '11':94B,100B '15':189B '15.8.7':138B '16.7.15':139B '18.7.2':132B '2026':90B,96B,191B 'access':85B,151B 'actual':168B 'ad':44B,53B,66B 'add':61B 'address':110B 'app':155B 'attack':41B,120B 'autoblog':75B 'bright.nl':73B 'campaign':37B 'chang':102B 'code':63B,105B,179B 'confirm':124B 'contact':163B 'coruna':143B 'crypto':157B 'data':108B 'day':56B 'dutch':70B 'earli':39B 'early-warn':38B 'effect':97B 'establish':174B 'exploit':128B,145B,149B 'extern':49B 'fix':186B 'geenstijl':59B,77B,140B 'give':150B 'hack':42B 'happen':86B 'hole':184B 'includ':72B 'io':131B,144B 'ip':109B 'iphon':129B,166B 'key':159B 'kit':146B 'languag':116B 'login':156B 'malici':62B 'manag':45B 'media':57B 'messag':160B 'name':141B 'next':55B 'nov':89B,95B,101B,190B 'number':80B 'older':134B 'os':117B 'page':111B 'password':154B 'per':58B 'photo':161B 'provid':54B 'referr':113B 'remov':181B 'run':51B 'save':153B 'say':177B 'screen':114B 'sent':106B 'server':121B 'shown':68B 'site':71B,82B,176B 'size':115B 'sourc':187B 'success':148B 'supplier':50B 'system':46B 'tag':67B 'taken':169B 'total':79B 'tri':126B 'tweaker':188B 'unknown':84B,103B 'version':136B 'vi.nl':74B 'visit':112B 'visitor':107B 'wallet':158B 'warn':40B 'whether':164B 'yet':173B","search_c":"","cause_entry":"unknown","cause_path":"third-party-breach","disclosures_checked_at":"2026-11-15T11:55:34+00:00","first_public_at":"2026-10-19T23:15:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-2tixcu","url":"https://tweakers.net/nieuws/254546/bright-punt-nl-vi-punt-nl-en-andere-websites-verspreidden-iphone-malware-via-advertenties.html","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-15T11:45:49+00:00","fetched_at":"2026-11-15T11:45:49+00:00","note":null,"cites":["https://tweakers.net/nieuws/254546/bright-punt-nl-vi-punt-nl-en-andere-websites-verspreidden-iphone-malware-via-advertenties.html"]}],"documents":[{"id":162811,"url":"https://news.ycombinator.com/item?id=50506066","title":"Dutch news websites were spreading iPhone-malware bia ads","kind":"post","source":"hackernews","publisher":null,"text":"Dutch news websites were spreading iPhone-malware bia ads\nhttps://tweakers.net/nieuws/254546/bright-punt-nl-vi-punt-nl-en-andere-websites-verspreidden-iphone-malware-via-advertenties.html\n\n3 points, 0 comments on Hacker News","published_at":"2026-11-15T11:20:58+00:00","relation":"describes","confidence":null,"note":null},{"id":162941,"url":"https://tweakers.net/nieuws/254546/bright-punt-nl-vi-punt-nl-en-andere-websites-verspreidden-iphone-malware-via-advertenties.html","title":"Bright.nl, VI.nl en andere websites verspreidden iPhone-malware via advertenties - Tweakers","kind":"blog","source":"analyst","publisher":null,"text":"Bright.nl, VI.nl, Autoblog, GeenStijl and other Dutch sites warn that early November they unknowingly served malicious code via ads. The ad management system of an external software supplier, managed by ad service provider Next Day Media (per GeenStijl), was hacked. Unauthorized access 1-3 Nov and again 11 Nov 2026. Code added to an ad tag sent visitor data (IP, pages visited, referrer, screen size, language, OS) to attacker server and tried to exploit iOS 18.7.2 and older, and versions before 15.8.7 and 16.7.15; GeenStijl says the code is the Coruna iOS exploit kit. Exploited flaws give access to saved passwords, app logins, crypto wallet keys, messages, photos, contacts. Not established whether iPhones were taken over; visitor data exfil confirmed. 11 Nov change effects unknown. Advice: update iOS, change passwords, move crypto to new wallet with new seed phrase.","published_at":"2026-11-15T08:54:17+00:00","relation":"describes","confidence":null,"note":null},{"id":4306,"url":"https://x.com/Unit42_Intel/status/2112321704148033732","title":"@Unit42_Intel: We've noted a group of domains associated with #Coruna-like and #DarkSword iOS e","kind":"post","source":"x","publisher":null,"text":"We've noted a group of domains associated with #Coruna-like and #DarkSword iOS exploit kit activity. In this example, one of the pages instructs viewers to open the content using Safari on their iPhone. More info at https://t.co/Xqx9stQGBf https://t.co/2IxKfKNCdQ\n\nlikes 82 reposts 13","published_at":"2026-10-19T23:15:13+00:00","relation":"discussion","confidence":null,"note":"@Unit42_Intel"},{"id":9850,"url":"https://x.com/malwrhunterteam/status/2115368700479975734","title":"@malwrhunterteam: inhlgaz3x59p6ak[.]icu\nTotally not a domain related to Coruna or some other explo","kind":"post","source":"x","publisher":null,"text":"inhlgaz3x59p6ak[.]icu\nTotally not a domain related to Coruna or some other exploit kit...\n😂\n🤷‍♂️ https://t.co/FyUJ0IzTMs\n\nlikes 6 reposts 1","published_at":"2026-10-28T09:02:54+00:00","relation":"discussion","confidence":null,"note":"@malwrhunterteam"}],"disclosures":[{"company":"GeenStijl","domain":"geenstijl.nl","url":"https://www.geenstijl.nl/5193093/belangrijke-veiligheidwaarschuwing-bezoekers-geenstijlnl","kind":"blog","published_at":"2026-11-14T00:00:00+00:00","quote":"Op GeenStijl.nl is begin november 2026 via advertentietechnologie kwaadaardige code (voor de kenners: het gaat om Coruna) verspreid.","confidence":0.949999988079071,"source":"model","created_at":"2026-11-15T11:54:59+00:00","entry":"unknown"},{"company":"Bright.nl","domain":"bright.nl","url":"https://www.bright.nl/nieuws/2158864/belangrijke-beveiligingswaarschuwing-voor-bezoekers-van-bright-nl.html","kind":"blog","published_at":"2026-11-14T00:00:00+00:00","quote":"Op Bright.nl is begin november 2026 via de advertentietechnologie kwaadaardige code verspreid.","confidence":0.9300000071525574,"source":"model","created_at":"2026-11-15T11:54:09+00:00","entry":"unknown"},{"company":"VI.nl","domain":"vi.nl","url":"https://www.vi.nl/nieuws/belangrijke-beveiligingswaarschuwing-voor-bezoekers-van-vi-nl","kind":"blog","published_at":"2026-11-14T00:00:00+00:00","quote":"Op VI.nl is begin november 2026 via de advertentietechnologie kwaadaardige code verspreid.","confidence":0.949999988079071,"source":"model","created_at":"2026-11-15T11:54:37+00:00","entry":"unknown"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}