Cybercriminals are deploying spyware on iPhones by using compromised websites and malicious online advertisements. These attacks can infect a device without any user interaction by simply displaying a malicious ad or opening an infected webpage.
Security researchers from iVerify and Report URI identified thousands of websites spreading malicious code as part of a hacking operation called DeadTag. At least 6,600 legitimate websites were affected by the operation, collectively receiving approximately 49 million monthly visits.
Among these, 248 websites were directly distributing the spyware. Attackers use two hacking tools, Coruna and DarkSword, to exploit security vulnerabilities in iOS.
The spyware can access a victim's messages, contacts, location information, passwords, and cryptocurrency wallet details. Researchers discovered an attack delivered through an Instagram advertisement that used a World Cup theme to deliver DarkSword spyware while a user was scrolling.
The primary goal of the attackers is to steal cryptocurrency from the affected devices. Most of these attacks target iPhones running outdated versions of iOS.
Apple has already released patches for the known vulnerabilities, but devices without the relevant security updates remain at risk. The total number of successfully infected iPhones is currently unknown.
