Spyware Campaign Targets iPhones via Legitimate Websites

• •Over 6,600 legitimate websites compromised to deliver spyware targeting iPhones.
• •Attacks exploit expired domains and legitimate ads, requiring no user interaction.
• •Cybercriminals are using advanced tools believed to originate from state-level intelligence.

Cybercriminals have exploited thousands of legitimate websites to deliver spyware targeting iPhones, enabling crypto theft without user interaction. Researchers identified two campaigns linked to suspected Chinese hackers, affecting at least 6,600 websites with a combined traffic of 49 million monthly visits. One notable incident involved an Instagram ad that infected a financial institution employee's device, stealing login credentials and cryptocurrency. The attackers utilize expired domains and malicious advertising code to redirect users to spyware. Tools used in these attacks include sophisticated exploit kits believed to have leaked from state intelligence agencies. The campaigns reflect a shift towards spyware delivery through routine web browsing rather than traditional phishing methods. Current efforts are focused on older, unpatched iOS versions, with indications that attackers are preparing updates for newer vulnerabilities.