Ordinary ads can break your iPhone: how hackers steal data via vulnerabilities

Cybersecurity experts from iVerify and Report URI have discovered new large-scale campaigns distributing spyware. Attackers have learned to infect iPhones directly while users browse ordinary web pages and view advertisements, exploiting vulnerabilities in the operating system. For a successful attack, users no longer need to click on suspicious links or download files, as the malicious code is delivered automatically.

New vector attacks via advertising networks

Researchers have documented at least two separate hacker campaigns employing fundamentally new approaches to mobile device infection. In the first case, an employee of a financial institution was targeted through Instagram while viewing a standard football match advertisement. The ad automatically identified the operating system version and triggered an exploit designed to steal login credentials and search for cryptocurrency wallets.

The second vector involves exploiting expired domains previously used for analytics or chatbot widgets on legitimate websites. Hacker groups bought approximately 630 such domains that served nearly 8,000 resources. As a result, malicious code began quietly redirecting users of outdated iOS versions to the attackers' infrastructure.

Transformation of cybercriminal tactics

Such methods indicate a radical shift in the approaches of modern hacker groups with potential ties to China. Instead of classic phishing campaigns, they are moving toward stealthy attacks during users' standard internet activity. Advertising platforms provide broad targeting capabilities, allowing attackers to select victims based on job titles, interests, or specific software versions.

Previously, similar incidents were recorded by researchers from Citizen Lab, who discovered the infection of 45 devices belonging to Al Jazeera media network employees using spyware without any action required from the owners. Experts emphasize that mobile devices are becoming a priority target for targeted espionage.

Protection measures and significance of the threat

The threat of infection through legitimate content increases the requirements for digital hygiene among regular smartphone owners and corporate users. The primary countermeasure remains timely updates to the iOS operating system, as most exploits rely on leveraging already known vulnerabilities in older software builds. Users are advised to monitor software currency and use specialized security solutions to detect abnormal network activity.