Silent Cyberattacks Target Apple Devices Through Web Ads

Cryptocurrency thieves have scaled up a sophisticated campaign targeting iPhone owners through passive drive-by cyberattacks, requiring victims merely to load a compromised webpage or view a rogue advertisement, according to cybersecurity researchers. Hundreds of mainstream platforms have been subverted in the scheme, with investigators uncovering at least one instance where malicious code was delivered directly through an Instagram advertisement.

Users aren’t visiting malicious websites. They’re not doing anything wrong. They’re just scrolling and being infected. — Rocky Cole, CEO and cofounder, iVerify

The campaign, primarily designed to drain digital funds from cryptocurrency wallets installed on targeted devices, demonstrates how easily everyday Apple users can be compromised simply by browsing social media feeds containing tainted ads, notes Cole, whose mobile security startup investigated the breaches after independent researcher Scott Helme identified the rogue code.

The Anatomy of the DeadTag Infrastructure

The discovery arrives closely on the heels of reports from Citizen Lab regarding government-grade spyware deployments targeting media personnel. While those operations leveraged state resources, investigators reveal that cybercriminals have quietly weaponized the broader online advertising ecosystem to execute parallel iOS attacks.

According to Scott Helme, CEO and founder of security firm Report URI, perpetrators utilized dormant domains and dormant code segments to inject iPhone exploits into thousands of authentic websites. The operation successfully embedded malware across roughly 6,600 legitimate domains that collectively draw 49 million monthly visits. Out of these, approximately 248 properties boasting 8 million monthly visitors actively function as a delivery network for iOS threats, while remaining sites redirect users to spam portals.

  • Total Compromised Sites: ~6,600 legitimate domains
  • Combined Monthly Traffic: 49 million visits
  • Active Delivery Networks: 248 websites
  • New Domain Creation Rate: Up to 10 domains weekly

Helme characterizes the perpetrators—whom his team has designated as the DeadTag collective—as infrastructure brokers renting out access to unwitting target audiences. The syndicate establishes up to 10 fresh domains weekly. Because the sheer scale of the infection makes direct notification cumbersome, researchers are actively coordinating with national cybersecurity agencies to streamline remediation efforts.

Exploit Kits and Unpatched iOS Vulnerabilities

Investigations indicate that one of DeadTag's clients operates an enterprise dedicated to breaching iPhones using a pair of exploit kits suspected of leaking from state-sponsored intelligence arsenals. These specific tools have been actively wielded by malicious actors since the spring season.

Although Apple has previously patched the foundational vulnerabilities exploited by these kits, the attackers strategically focus their efforts on users who fail to maintain updated operating systems. Furthermore, code analysis conducted by Helme uncovered provisions allowing the hackers to seamlessly integrate fresh zero-day exploits as new iOS vulnerabilities emerge.

While investigators remain uncertain of the true geographical origins or identities behind the DeadTag syndicate and its clientele, code analysis revealed that portions were written in Chinese. Additional inquiries uncovered that various domains associated with the campaign utilized a China-based web security provider for defensive shielding against counter-attacks. Representatives for Apple and Meta had not issued official statements at the time of reporting.