Hackers are turning web browsing into a spyware trap

Researchers at iVerify and Report URI identified two distinct campaigns that delivered spyware to iPhones without requiring victims to click malicious links. The findings, shared with Axios on Thursday, demonstrate how criminal groups with suspected ties to China are exploiting online advertising infrastructure and legitimate websites to steal cryptocurrency and login credentials.

In one instance, iVerify discovered that a financial institution employee’s iPhone was compromised after the user scrolled past a professional soccer advertisement on Instagram. The ad automatically triggered the attack, which proceeded to steal the individual's login credentials and scan their cryptocurrency wallets. This method eliminated the traditional need for user interaction, as malicious code began executing the moment the advertisement appeared on the screen. The attack sequence included a check of the iPhone's operating system to ensure a compatible exploit was deployed.

The second campaign, uncovered by Report URI, affected nearly 8,000 legitimate websites. Hackers purchased roughly 630 expired domains that these sites still relied upon for features such as chatbots and analytics tools. By controlling these domains, attackers redirected vulnerable iPhone visitors toward spyware designed to harvest credentials and digital assets. This approach allowed criminals to quietly redirect traffic from trusted sources to malicious software.

Both campaigns exploit tools that load automatically during standard web browsing. This shift moves cybercriminal activity away from traditional phishing attacks toward infrastructure embedded in everyday online activity. These techniques enable attackers to focus on specific devices by filtering audiences through ad platforms or inspecting visitor system details before launching an exploit.

Rocky Cole, co-founder and chief operating officer at iVerify, stated that spyware is now "the fastest proliferating threat to mobile devices at the current moment." The research highlights a broader trend of weaponizing spyware against mobile phones, which have often been viewed as having ironclad security. Last year, iVerify uncovered evidence of the first spyware campaign targeting iPhones in the U.S. and the European Union. Additionally, researchers at the University of Toronto's Citizen Lab recently confirmed the first public instance of zero-click spyware delivered via targeted ads, affecting at least 45 devices within international news network Al Jazeera.

Scott Helme, founder and CEO at Report URI, noted the likely origin of the actors behind these campaigns: "They're either Chinese or they definitely want us to think that they are." Researchers warn that the growing availability of sophisticated spyware is forcing consumers to rethink their protection strategies. Both Cole and Helme emphasized keeping mobile operating systems updated, as these attacks depend on exploiting vulnerabilities in specific software versions.