Cybersecurity researchers have uncovered sophisticated new campaigns that transform everyday web browsing into a spyware trap for iPhone users, eliminating the traditional requirement for victims to click on malicious links. Once deployed primarily against high-value targets such as politicians and journalists, spyware is increasingly falling into the hands of everyday cybercriminals intent on stealing cryptocurrency and sensitive login credentials.
Two separate research teams disclosed their findings regarding campaigns driven by criminal groups with suspected ties to China. Researchers at iVerify and Report URI revealed that attackers are exploiting online advertising infrastructure and legitimate website dependencies to quietly deliver malicious software to vulnerable mobile devices.
In the first case documented by iVerify, a financial institution employee’s iPhone was compromised simply by scrolling past a professional soccer advertisement displayed on Instagram. The ad automatically initiated an attack sequence that harvested the victim’s login credentials and scanned their cryptocurrency wallets. The malicious code began executing the moment the advertisement rendered on the screen, first checking the device’s operating system to deploy a compatible exploit.
The second campaign, uncovered by Report URI, impacted nearly 8,000 legitimate websites. Attackers purchased approximately 630 expired domains that these websites still relied upon to host background features such as chatbots and analytics tools. Because the host sites continued loading code from those defunct domains, criminals were able to quietly redirect vulnerable iPhone visitors toward spyware designed to siphon credentials and digital currency.
Both vectors bypass the need to trick users into clicking suspicious links by weaponizing tools that load automatically during standard internet browsing. Furthermore, these methods enable precise targeting. Advertising platforms allow operators to narrow audiences by specific user interests and device characteristics, while the malicious code embedded in compromised websites can automatically detect a visitor’s operating system before selecting an appropriate attack payload.
These developments illustrate a broader shift among cybercriminals toward building automated infrastructure for delivering mobile spyware through routine online activity. Last year, iVerify discovered evidence of the first spyware campaign targeting iPhones across the United States and the European Union. More recently, researchers at the University of Toronto’s Citizen Lab documented the first public confirmation of zero-click spyware delivered via targeted ads against at least 45 devices belonging to staff at an international news network.
Rocky Cole, co-founder and chief operating officer at iVerify, described spyware as the fastest proliferating threat currently facing mobile devices, challenging the long-held assumption that mobile operating systems like iOS and Android provide ironclad security.
Regarding the actors behind the operations, Scott Helme, founder and chief executive officer at Report URI, noted the ambiguity surrounding their origins. They are either Chinese or deliberately attempting to project that attribution.
As sophisticated spyware becomes more widely accessible, security experts warn that consumers must fundamentally rethink mobile device protection. Because these attacks rely heavily on exploiting vulnerabilities in specific software versions, researchers emphasize the critical importance of keeping mobile operating systems continuously updated.
