---
title: "Ordinary ads can break your iPhone: how hackers steal data via vulnerabilities"
description: "Experts at iVerify and Report URI revealed new cyberattacks on iPhones via ads and expired domains without user action."
date: 2026-10-23T12:23:32.230Z
lang: en
url: https://xab.info/en/posts/ordinary-ads-can-break-iphone-hackers
tags: [iphone, cybersecurity, spyware, hackers, ios, malware]
author: "Alexander Buran"
publisher: "XAB.info"
---

# Ordinary ads can break your iPhone: how hackers steal data via vulnerabilities

![Person in a hoodie sitting in the dark at a laptop checking a smartphone](https://xab.info/media/2026/10/23/obychnaja-reklama-mozhet-slomat-iphone-hakery/obychnaja-reklama-mozhet-slomat-iphone-hakery-1.webp)

## Key Points

- Hackers infect iPhones through regular advertisements and expired domains
- Victims do not need to click links or download suspicious files
- Attacks target login credentials and access to cryptocurrency wallets
- Experts link the campaigns to structures with interests in China
- The primary protection method is timely updating of the iOS operating system

Cybersecurity experts from iVerify and Report URI have discovered new large-scale campaigns distributing spyware. Attackers have learned to infect iPhones directly while users browse ordinary web pages and view advertisements, exploiting vulnerabilities in the operating system. For a successful attack, users no longer need to click on suspicious links or download files, as the malicious code is delivered automatically.

### New vector attacks via advertising networks

Researchers have documented at least two separate hacker campaigns employing fundamentally new approaches to mobile device infection. In the first case, an employee of a financial institution was targeted through Instagram while viewing a standard football match advertisement. The ad automatically identified the operating system version and triggered an exploit designed to steal login credentials and search for cryptocurrency wallets.

The second vector involves exploiting expired domains previously used for analytics or chatbot widgets on legitimate websites. Hacker groups bought approximately 630 such domains that served nearly 8,000 resources. As a result, malicious code began quietly redirecting users of outdated iOS versions to the attackers' infrastructure.

### Transformation of cybercriminal tactics

Such methods indicate a radical shift in the approaches of modern hacker groups with potential ties to China. Instead of classic phishing campaigns, they are moving toward stealthy attacks during users' standard internet activity. Advertising platforms provide broad targeting capabilities, allowing attackers to select victims based on job titles, interests, or specific software versions.

Previously, similar incidents were recorded by researchers from Citizen Lab, who discovered the infection of 45 devices belonging to Al Jazeera media network employees using spyware without any action required from the owners. Experts emphasize that mobile devices are becoming a priority target for targeted espionage.

### Protection measures and significance of the threat

The threat of infection through legitimate content increases the requirements for digital hygiene among regular smartphone owners and corporate users. The primary countermeasure remains timely updates to the iOS operating system, as most exploits rely on leveraging already known vulnerabilities in older software builds. Users are advised to monitor software currency and use specialized security solutions to detect abnormal network activity.

## Fact-Check & Sources

- [Обычная реклама может сломать iPhone: как хакеры воруют данные](https://www.rbc.ua/ukr/news/zvichayna-reklama-mozhe-zlamati-iphone-k-1792753250.html) - The original source confirms all details regarding iPhone cyberattacks via ads and expired domains.

## FAQ

### Do I need to click a link to infect an iPhone?

No, new attack methods allow the device to be infected automatically while browsing web pages or viewing ads.

### Which companies recorded these cyberattacks?

The spyware distribution campaigns were discovered by researchers from iVerify and Report URI.

### How to protect against such threats?

Experts recommend regularly updating the iOS operating system to patch vulnerabilities exploited by attackers.