Hackers Use Ads and Expired Domains to Spread iPhone Spyware

Researchers at iVerify and Report URI said Thursday that criminal groups suspected of links to China used advertising systems and legitimate websites to distribute iPhone spyware. Spyware previously used against politicians, journalists and other prominent targets is becoming available to ordinary cybercriminals seeking cryptocurrency and login credentials. Both campaigns used components that run automatically during browsing, so victims did not need to click a malicious link.

In one campaign, iVerify found that a financial institution employee's iPhone became infected while the employee scrolled past an Instagram advertisement about professional soccer. The advertisement triggered an attack that took the employee's login credentials and searched the employee's cryptocurrency wallets. Malicious code started executing when the advertisement became visible on the screen. The attack identified the iPhone's operating system and then deployed a compatible exploit.

Report URI identified another campaign affecting nearly 8,000 legitimate websites after attackers bought roughly 630 expired domains that the websites continued to use. Those domains had previously hosted legitimate features, including chatbots and analytics tools. Thousands of websites continued retrieving code from the expired domains, enabling attackers to redirect visitors without drawing attention. The attackers redirected visitors using vulnerable iPhones toward spyware intended to steal login credentials and cryptocurrency.

The campaigns demonstrate how criminals are developing spyware distribution systems based on routine internet use rather than conventional phishing or attacks aimed at particular individuals. Both techniques also let attackers select vulnerable devices. Advertising platforms can select audiences using interests and device attributes. Malicious code on websites can detect a visitor's operating system before choosing an attack.

Cybercriminals increasingly use spyware against mobile phones, despite widespread perceptions that iPhones and Android devices have highly reliable security. Last year, iVerify found evidence of the first spyware campaign aimed at iPhones in the United States and the European Union. Last week, researchers at the University of Toronto's Citizen Lab found the first publicly confirmed instance of targeted advertisements delivering zero-click spyware. That campaign targeted at least 45 devices at the international news network Al Jazeera.

Rocky Cole, iVerify's co-founder and chief operating officer, described spyware as "the fastest proliferating threat to mobile devices at the current moment." Scott Helme, Report URI's founder and CEO, said of the groups behind the campaigns: "They're either Chinese or they definitely want us to think that they are." Researchers warn that increasingly accessible sophisticated spyware is forcing consumers to reconsider how consumers secure mobile phones.