Two no-click iPhone spyware campaigns reportedly used ads and website code

Researchers at iVerify and Report URI described two separate iPhone spyware campaigns to Axios, both using content that loads without a malicious-link click. An Instagram soccer ad reportedly infected an employee's phone, while attackers used roughly 630 expired domains to redirect vulnerable visitors from nearly 8,000 legitimate sites toward spyware. The website figure counts affected sites, not infected phones; Axios gives no infection count for that campaign.