Cybercriminals are employing deceptive Instagram ads and abandoned website tracking tools to infect unsuspecting iPhones without requiring users to click on the ads. Researchers have identified this tactic as "half-click" attacks, where users only need to visit an affected site or browse a social media feed. Instagram Ads Exploit iPhones Report URI revealed a traffic operation called DeadTag that purchases expired domains previously used by advertising and analytics services.
These sites collectively attract approximately 135 million monthly visits, representing potential exposure rather than confirmed infections or unique compromised devices. Instagram Ads Target iPhones, DarkSword Exploits PrestaShop Stores (Source: iverify) Security researchers discovered DarkSword loaders on hundreds of PrestaShop websites, concealed within folders that resemble analytics components. Potential explanations remain unproven.
Targeted wallet applications include Coinbase Wallet, Trust Wallet, Exodus, TronLink, Bitpie, OKX, and Bitget.
Financial theft appears to be the primary motive, though the collected information could potentially support additional criminal activities. Chinese-language code comments and infrastructure linked to Chinese-language cryptocurrency and gambling sites indicate a Chinese-speaking exploit team, but do not confirm their nationality or government involvement. Individuals at high risk should look into Lockdown Mode, while businesses should keep an eye on mobile devices and investigate any suspicious activity.
Join 16,000+ SOC teams using ANY.RUN to simplify threat investigations and decrease manual workload.
