--- id: "CMP-202611-2tixcu" page: "https://infrastack.ai/live/CMP-202611-2tixcu" kind: "campaign" aliases: [] title: "Dutch news sites (Bright.nl, VI.nl, GeenStijl, Autoblog) served the Coruna iPhone exploit kit through hacked ads, stealing visitor data and targeting outdated iOS" severity: "high" cvss: null epss: null exploited: true status: "open" category: "vendor" products: [{"name": "iOS", "fixed": [], "vendor": "Apple", "affected": "<=18.7.2, <15.8.7, <16.7.15"}, {"name": "Next Day Media ad platform", "fixed": [], "vendor": "Next Day Media"}, {"name": "Bright.nl", "note": "disclosed by the company", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "VI.nl", "note": "disclosed by the company", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "GeenStijl", "note": "disclosed by the company", "fixed": [], "affected": "", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["campaign", "early-warning"] not_affected_if: [] published_at: null first_seen_at: "2026-11-15T11:45:49+00:00" updated_at: "2026-11-15T11:54:59+00:00" sources: [{"source": "analyst", "url": "https://tweakers.net/nieuws/254546/bright-punt-nl-vi-punt-nl-en-andere-websites-verspreidden-iphone-malware-via-advertenties.html", "first_seen_at": "2026-11-15T11:45:49+00:00", "cites": ["https://tweakers.net/nieuws/254546/bright-punt-nl-vi-punt-nl-en-andere-websites-verspreidden-iphone-malware-via-advertenties.html"]}] exploit_sources: [] --- # Dutch news sites (Bright.nl, VI.nl, GeenStijl, Autoblog) served the Coruna iPhone exploit kit through hacked ads, stealing visitor data and targeting outdated iOS Link for people: https://infrastack.ai/live/CMP-202611-2tixcu (this .md is for agents) Attackers hacked the ad management system of an external supplier run by ad provider Next Day Media (per GeenStijl) and added malicious code to an ad tag shown on Dutch sites including Bright.nl, VI.nl, Autoblog and GeenStijl; the total number of sites is unknown. Access happened 1-3 Nov 2026 and again on 11 Nov 2026 (effect of the 11 Nov change unknown). The code sent visitor data (IP address, pages visited, referrer, screen size, language, OS) to an attacker server, which is confirmed, and tried to exploit iPhones on iOS 18.7.2 and older and versions before 15.8.7 / 16.7.15 (GeenStijl names the Coruna iOS exploit kit). A successful exploit gives access to saved passwords, app logins, crypto wallet keys, messages, photos and contacts. Whether any iPhones were actually taken over is not yet established. The sites say the code is removed and the hole is fixed. Source: Tweakers, 15 Nov 2026. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - :iOS affected <=18.7.2, <15.8.7, <16.7.15 fixed no fixed version listed - :Next Day Media ad platform affected range not listed fixed no fixed version listed - vendor:Bright.nl affected range not listed fixed no fixed version listed - vendor:VI.nl affected range not listed fixed no fixed version listed - vendor:GeenStijl affected range not listed fixed no fixed version listed ## Cause How the attacker got in, by company (from each company's own statement): - Bright.nl: not disclosed yet - GeenStijl: not disclosed yet - VI.nl: not disclosed yet How it reached others: customers' data or keys went with it (third-party-breach). Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/breaches.md#third-party-breach ## How to check iPhones that visited Bright.nl, VI.nl, Autoblog, GeenStijl or other Dutch sites carrying Next Day Media ads between 1 and 3 Nov or on/after 11 Nov 2026 while on iOS 18.7.2 or older (or older than 15.8.7 / 16.7.15 on legacy branches) are at risk. Attacker server, domains and other indicators are unknown so far. Sites that use Next Day Media ad tags: check the ad tag for injected code. ## Fix Update iPhones to the latest iOS (at least past 18.7.2, or 15.8.7 / 16.7.15 on older devices). If an outdated iPhone visited the affected sites, change passwords and app logins, and move crypto to a new wallet with a new recovery phrase. Consider Lockdown Mode for high-risk users. Publishers using Next Day Media should review their ad tags. ## Timeline - 2026-11-14T00:00:00+00:00 confirmed by GeenStijl (blog) https://www.geenstijl.nl/5193093/belangrijke-veiligheidwaarschuwing-bezoekers-geenstijlnl "Op GeenStijl.nl is begin november 2026 via advertentietechnologie kwaadaardige code (voor de kenners: het gaat om Coruna) verspreid." - 2026-11-14T00:00:00+00:00 confirmed by VI.nl (blog) https://www.vi.nl/nieuws/belangrijke-beveiligingswaarschuwing-voor-bezoekers-van-vi-nl "Op VI.nl is begin november 2026 via de advertentietechnologie kwaadaardige code verspreid." - 2026-11-14T00:00:00+00:00 confirmed by Bright.nl (blog) https://www.bright.nl/nieuws/2158864/belangrijke-beveiligingswaarschuwing-voor-bezoekers-van-bright-nl.html "Op Bright.nl is begin november 2026 via de advertentietechnologie kwaadaardige code verspreid." - 2026-11-15T11:45:49+00:00 analyst https://tweakers.net/nieuws/254546/bright-punt-nl-vi-punt-nl-en-andere-websites-verspreidden-iphone-malware-via-advertenties.html ## Documents - [describes] Dutch news websites were spreading iPhone-malware bia ads https://news.ycombinator.com/item?id=50506066 - [describes] Bright.nl, VI.nl en andere websites verspreidden iPhone-malware via advertenties - Tweakers https://tweakers.net/nieuws/254546/bright-punt-nl-vi-punt-nl-en-andere-websites-verspreidden-iphone-malware-via-advertenties.html - [discussion] @Unit42_Intel: We've noted a group of domains associated with #Coruna-like and #DarkSword iOS e https://x.com/Unit42_Intel/status/2112321704148033732 - [discussion] @malwrhunterteam: inhlgaz3x59p6ak[.]icu Totally not a domain related to Coruna or some other explo https://x.com/malwrhunterteam/status/2115368700479975734 --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_