AnswersPublished22 sources
How Online Ads and Forgotten Website Tags Became iPhone Spyware Traps
iVerify and Report URI reported two campaigns that could deliver iPhone spyware through an Instagram ad or code loaded by a legitimate website, without a click on a malicious link.
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- iVerify and Report URI reported two campaigns that could deliver iPhone spyware through an Instagram ad or code loaded by a legitimate website, without a click on a malicious link.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What did iVerify and Report URI uncover about two suspected China-linked criminal campaigns spreading zero-click iPhone spyware through onli. Article summary: iVerify and Report URI reported two campaigns in which suspected China-linked criminal groups used online advertising and legitimate websites to deliver iPhone spyware without victims clicking a malicious link. The findi. Topic tags: general, general web, user generated, education. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, cha
An Instagram ad for professional soccer and forgotten code on legitimate websites were two reported routes for delivering spyware to iPhones. iVerify and Report URI say the campaigns could trigger an attack without a victim clicking a suspicious link. The groups were described as having suspected ties to China; the available reporting does not establish who directed them. 2
3
Two routes to an iPhone infection
In one case, iVerify found that an employee of a financial institution was infected after scrolling past a professional soccer ad on Instagram. The attack stole login credentials and searched the phone for cryptocurrency wallets. One report says the malware checked the iPhone’s operating system before proceeding, but the available accounts do not provide enough detail to independently verify the complete exploit-selection sequence. 1
2
The other route began with expired domains still referenced by legitimate websites. When a third-party analytics or advertising domain expires and is registered by someone else, old site tags that continue to load that domain can become an attacker-controlled entry point. Report URI describes attackers acquiring expired domains behind website tags and using them to redirect visitors toward exploit delivery. A person need not knowingly visit an attacker-created site for a compromised dependency on a legitimate page to load. 3
11
What the site-count figures do—and don’t—show
The reports give different counts, and they should not be treated as interchangeable measures of infection:
- One account describes roughly 630 expired domains and nearly 8,000 legitimate websites still using them.
3
- Other reporting cites at least 6,600 compromised sites with about 49 million visits per month.
4
6
- A separate estimate identifies 248 sites, accounting for about 8 million monthly visits, as directly distributing spyware.
31
These are estimates of domains, websites, or website traffic—not confirmed counts of infected iPhones. The available reporting does not explain how to reconcile the nearly 8,000 and 6,600 site totals, so they are best presented as different reported figures rather than a single settled count.
Coruna, DarkSword and the limits of attribution
Report URI and iVerify identified the iOS exploit kits Coruna and DarkSword in their research into the delivery ecosystem. iVerify said it had occasionally seen the kits bundled together, calling that combination “DarkCoruna,” and said it believed attackers had obtained and modified Coruna’s source code. 5
11
The China connection remains an attribution claim with limits: reporting describes the criminal groups as suspected of having ties to China, not as conclusively directed by the Chinese government. 2
3 The available sources do not establish state sponsorship.
A wider warning about spyware delivery
The findings add to a broader concern about ads serving as an infection channel. Citizen Lab’s separate AdFection research described targeted advertising used to deliver zero-click mercenary spyware; that work is related context, not proof that the same operators or tools were behind these iPhone campaigns. 18
The practical lesson is that a malicious link is not the only possible route to compromise: an ad appearing in a feed or a vulnerable website loading a hijacked tag can expose a device. Keeping an iPhone updated is a sensible baseline, but these reports do not identify a single iOS version that protects against every attack described. 7
15
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "How Online Ads and Forgotten Website Tags Became iPhone Spyware Traps"?
iVerify and Report URI reported two campaigns that could deliver iPhone spyware through an Instagram ad or code loaded by a legitimate website, without a click on a malicious link.