Malicious Ad Campaigns Infect iPhones via Web Browsing
Attackers are using 8,000 hijacked domains to distribute spyware through ads, bypassing traditional security.
Updated on Oct. 24, 2026 in Cybersecurity
Live Poll
Do you trust that your smartphone is secure from spyware attacks even without clicking suspicious links?
Researchers have discovered two malicious campaigns that have compromised at least 6,600 websites to serve spyware. By hijacking 8,000 domains and leveraging leaked state-level toolkits, attackers are successfully targeting and infecting devices through automated ad-based delivery.
Why it matters
These campaigns demonstrate a shift toward leveraging expired domain infrastructure and ad-targeting to bypass traditional perimeter security. The exploitation of unpatched iOS flaws highlights the persistent risk posed by leaked, high-tier surveillance toolkits in the hands of private criminal groups.
The attackers purchased 630 expired domains that previously served analytics or chatbot functions for 8,000 legitimate websites. Once a user visits these sites, the malicious code detects the device OS and executes a toolkit designed to exploit unpatched iOS vulnerabilities.
The players
DeadTag
A criminal group suspected of selling access to compromised websites and managing the distribution of stolen login credentials.
Citizen Lab
A research facility based in Toronto that focuses on identifying advanced spyware, surveillance technology, and digital security threats.
Apple
The technology corporation responsible for the iOS operating system and its underlying security architecture.
The details
The infection process relies on ad-tech integration where a hijacked domain serves malicious scripts during standard page loads. Upon detecting an iPhone, the code deploys an exploit toolkit—software designed to identify and gain control of a system by triggering unpatched software flaws. The payload is specifically engineered to scrape cryptocurrency wallets and login credentials from the device memory. This mechanism persists even if the user only views an ad, such as one encountered while scrolling through a social media feed.
Timeline
Spring 2026: Criminal groups began utilizing two leaked state-level attack toolkits.
October 15, 2026: Citizen Lab documented a separate attack on Windows PCs via malicious advertisements.
October 22, 2026: Researchers published findings detailing the global spyware network.
The Tech Race
This campaign represents a significant escalation from previous ad-based attacks that were primarily limited to desktop environments. Researchers are now tracing how sophisticated spyware toolkits, once exclusive to state actors, are being integrated into mass-market ad-tech infrastructure.
Users can be exposed to these spyware toolkits simply by browsing websites that display common advertisements. Currently, protection relies on keeping iOS devices updated to patch the vulnerabilities that these leaked toolkits actively target.
The takeaway
The use of expired domains to hijack site functionality serves as a reminder to monitor software supply chains for abandoned third-party dependencies. Analysts will be watching for potential security patches from Apple that address the unpatched flaws currently exploited by these campaigns.
Further reading
For more information on current digital threats, visit our section on Cybersecurity.
Live Poll
Do you trust that your smartphone is secure from spyware attacks even without clicking suspicious links?
