Dutch News Sites Served iPhone-Hacking Code Through Their Ads: Who Was at Risk
For several days in early November, reading an article on VI.nl, GeenStijl or more than a dozen other Dutch websites could be enough to expose an outdated iPhone to a hacking attempt.
The code didn’t come from the sites themselves. Someone broke into the system that places their ads and slipped JavaScript into an ad tag, the small script that loads ads on every page. The code collected data about every visit and tried to break into iPhones that had missed security updates. Nobody had to click on anything.
The affected sites posted warnings on the evening of November 14. Dutch broadcaster NOS reported on November 15 that at least 14 Dutch sites and one Belgian site have warned their visitors. When we published, we found no English-language reports.
What Happened
VI.nl says its ads run on a system supplied by an outside software vendor and managed by a separate ad service provider, and that other websites use the same technology. According to its notice, an unauthorised person got into that management system and changed an ad tag used on VI.nl and elsewhere.
NOS names the ad company as NextDay. NextDay is the advertising arm of the publisher PXR, which sells ads on its own titles and on sites of independent publishers. It says it serves 150 websites with about 12 million unique visitors a month. That doesn’t mean all 150 ran the bad code, and nobody has said how many people saw it.
The sites named so far are VI, VoetbalPrimeur, VoetbalNieuws, Bright, Scientias, Autoblog, Autoreview.nl, GeenStijl, De Dagelijkse Standaard, BabyBytes and the Dutch editions of Men’s Health, Women’s Health, Runner’s World and Bicycling. The Belgian site hasn’t been named.
The code ran in three periods, all in Dutch time (UTC+1):
- November 1, from about 09:50, to November 3 at 10:07. The part aimed at iPhones was active from about 14:44 on November 1.
- November 3, from about 12:06 to 17:20. Malicious code was added again.
- November 11, from about 15:34 to 15:50. Another unauthorised change. The sites say they don’t yet know what it contained or did.
The code did two things. It sent visit details to the attackers’ server: IP address, the pages read, the page you came from, screen size, language settings and the operating system. And it carried parts built to exploit security holes in older iPhones.
The sites say the code has been removed, the hole in the ad management system was closed on November 11, and the unauthorised accounts and sessions were deleted. The investigation is still going.
Was Your iPhone at Risk?
Only if you visited one of the sites in those periods with an iPhone that had missed specific updates.
If an attack worked, the attackers may have reached saved passwords, app logins and the access keys of crypto wallets, the sites say, and possibly messages, photos and contacts. They also say they can’t tell for each visitor whether the code loaded, and that no individual iPhone has been confirmed as hacked. A visit, VI writes, doesn’t automatically mean your phone was compromised.
None of the notices names the attack tool. GeenStijl linked it to Coruna, according to tech site Dutchcowboys. Google’s researchers say Coruna only works up to iOS 17.2.1, though, so it can’t explain the iOS 18 phones on the list.
The iOS 18 cut-off lines up with DarkSword, a newer kit that Google says targets iOS 18.4 to 18.7 and that Apple fixed in steps up to iOS 26.3. A version of DarkSword leaked on GitHub in March, which put it within reach of ordinary criminals. That match is our reading of the version numbers. The sites haven’t confirmed which tool it was, and the code may have combined both.
Ads have been a delivery route for these kits before. In October, security firms iVerify and Report URI described Coruna and DarkSword reaching iPhones through forgotten tracking scripts on thousands of sites, and DarkSword through a World Cup ad on Instagram. Our guide to whether an iPhone can get a virus from a website explains how these web attacks work and which updates stop them.
What to Do Now
If your iPhone was up to date, or you didn’t visit any of these sites in those periods, you don’t need to do anything about this incident.
If your iPhone was in the risk group, the sites advise these steps:
- Update now under Settings, General, Software Update. An update closes the holes, but it can’t undo a theft that already happened.
- Change the passwords saved on that iPhone, starting with your email, your Apple Account and your bank. Do it from another device you trust if you can. Turn on two-step verification where it’s offered, and check for logins you don’t recognise.
- Move crypto to a new wallet if you used one on that phone, with a new recovery phrase made on a secure device. A new password won’t help if the recovery phrase or a private key was taken.
- Watch your accounts for unknown logins and transactions, and contact the provider at once if you spot any.
- Be wary of messages about this incident. Emails or texts that mention it and ask you to click a link or share data may come from the attackers.
If your iPhone can’t install a current update, Apple recommends Lockdown Mode, which it says protects against these web attacks even on older software. The sites take questions at [email protected] or 085-1307628.
What the Notices Leave Out
Visit data such as IP addresses counts as personal data under the GDPR. A company that loses control of it has to tell the data protection authority within 72 hours, unless the breach is unlikely to put people at risk. None of the notices says whether the Dutch authority, the Autoriteit Persoonsgegevens, has been told. They also don’t say how many visitors loaded the code, or where the stolen visit data went.
For readers, the lesson is an uncomfortable one. A trusted news site can’t vouch for every script its ad partners load, and here the ad system itself was the way in. Keeping your iPhone updated is what stopped this attack. An ad blocker in Safari can keep many ad scripts off the page as well, at the cost of the sites’ income.
We have asked PXR and NextDay how the attackers got into the ad system, how many visitors loaded the code, and whether the Autoriteit Persoonsgegevens was notified. We’ll update this article when they answer.
Our Mission
We believe security online security matters and its our mission to make it a safer place.