Thousands of Popular Websites Weaponised to Drain Crypto Wallets from Apple iPhones ...

Cybercriminals have compromised thousands of legitimate websites to deliver invasive spyware engineered to execute iPhone crypto theft , draining digital wallets from devices without requiring victims to click an infected link or download a file.

The Invisible Hijack: How Legitimate Sites Became Spyware Hubs

The scale of the operation reaches far beyond obscure corners of the dark web. Cybersecurity specialist Scott Helme, founder of Report URI, identified code running across at least 6,600 legitimate websites that attract a combined 49 million visits every month.

Among those destinations, 248 mainstream websites drawing roughly eight million monthly visitors function as an active delivery pipeline for malicious iOS payloads. In one notable instance, malicious advertising code successfully surfaced directly within social media feeds on Instagram .

“Users aren’t visiting malicious websites. They’re not doing anything wrong. They’re just scrolling and being infected,” revealed Rocky Cole, chief executive and co-founder of mobile security firm iVerify . The primary goal of these attacks centres squarely on siphoning funds from digital asset wallets stored on targeted handsets.

The perpetrators, tracked by researchers under the moniker the DeadTag crew, systematically acquire expired domains and unmaintained script references. By injecting their own infrastructure into these dormant tracking links, they established an automated cybercrime marketplace.

The syndicate registers as many as 10 fresh domains every week, selling access to secondary hacker outfits seeking direct avenues into consumer devices.

Repurposed Spyware: Leaked Intelligence Tools in Criminal Hands

The software deployed against visitors is not ordinary adware. Analysts found that DeadTag’s buyers are deploying two sophisticated exploit kits widely believed to have leaked from state-level intelligence agencies.

These exploits—dubbed Coruna and DarkSword—were previously reserved for elite espionage operations before trickling down into the commercial cybercrime ecosystem. Criminals have actively leveraged these leaked tools to breach Apple devices, deliberately hunting for targets running older, unpatched iOS builds.

The Architecture of the Attack Chain

Targeted Tag Infiltration: Attackers scan the broader internet for broken analytics scripts and abandoned domain names lingering in commercial site templates.

Traffic Monetisation: The DeadTag network sells malicious redirect pathways, funnelling millions of visitors toward exploit servers.

Silent Wallet Drainage: Once injected into memory, the weaponised code searches the device environment to compromise software credentials and trigger iPhone crypto theft .

Modular Exploitation: While Apple has deployed software patches for earlier flaws exploited by these kits, forensic analysis of the attack scripts indicates the syndicate is preparing modular updates to insert exploits targeting newer iOS vulnerabilities.

Forensic inspection of the command scripts showed code written in Chinese, alongside domains routed through Chinese internet security infrastructure to deflect countermeasures. Helme is coordinating with national cybersecurity organisations to expedite takedowns, though the sheer volume of compromised sites makes notifications exceptionally complex.

Protecting Digital Assets Against Passive Exploits

Because these drive-by infections avoid traditional social engineering tactics, standard browsing caution is no longer enough to insulate consumer funds. Safeguarding mobile assets demands aggressive device hygiene.

Immediate Operating System Updates: Install all pending iOS updates immediately to patch known vulnerability chains exploited by leaked toolkits.

Segregated Crypto Storage: Move significant balances from mobile software applications to dedicated hardware cold storage devices.

Aggressive Network Script Blocking: Use mobile browsers or local content blockers configured to suppress external ad network scripts and expired tracking tags.

💡 The commercialisation of state-grade surveillance code represents an escalating frontier for retail investors holding assets on consumer mobile hardware.

🔍 As criminal crews treat mainstream online advertising as an open gateway into personal devices, staying protected requires treating system updates as critical financial security.

📌 Have you noticed unexpected activity in your mobile wallet or encountered strange redirects while browsing? your perspective in the below.