Researchers at iVerify and Report URI uncovered two separate campaigns that used automatically loaded ads and website code to deliver iPhone spyware, Axios reports. Neither required a victim to click a malicious link, according to the outlet.
In the first case, iVerify found that a financial institution employee's iPhone was infected after the employee scrolled past a professional soccer ad on Instagram, according to Axios. Malicious code ran when the ad appeared and checked the phone's operating system before deploying a compatible exploit. Axios says the attack stole login credentials and searched the employee's cryptocurrency wallets. Searching the wallets does not establish that cryptocurrency was stolen.
Report URI described a different route. Attackers bought roughly 630 expired domains once used for website features such as chatbots and analytics tools. Nearly 8,000 legitimate websites were still loading code from those domains, allowing attackers to redirect vulnerable iPhone visitors toward spyware designed to steal credentials and cryptocurrency, Axios reports. The nearly 8,000 figure counts affected websites, not infected phones; Axios gives no infection count for this campaign.
Axios describes the groups behind the campaigns as having suspected ties to China, not established Chinese identities. A BGR account of spyware delivered through targeted ads to Al Jazeera devices concerns a separate attack, not either of these campaigns. For the attacks Axios covered, iVerify's Rocky Cole and Report URI's Scott Helme emphasized keeping mobile operating systems updated because the exploits depend on vulnerabilities in specific software versions.
Comments