Imagine sitting on the couch with your phone, casually scrolling through Instagram between meetings or during a lazy afternoon. An advertisement drifts across your screen, a brightly colored rectangle promoting something that has nothing to do with you. You don’t tap it. You don’t click through. You barely even look at it. But according to cybersecurity researchers, that single moment of passive scrolling may be enough to put an iPhone in the hands of criminals. Forbes reports that a large-scale cyberattack is quietly targeting Apple users through a sneaky method that doesn’t require them to do anything except view an ad or visit an infected webpage. Hundreds of websites have been compromised in this campaign, and in at least one case, a malicious ad was served directly over Instagram. “Users aren’t visiting malicious websites. They’re not doing anything wrong. They’re just scrolling and being infected,” says Rocky Cole, CEO and cofounder of mobile security startup iVerify. The finding came after cybersecurity researcher Scott Helme discovered that hundreds of infected websites were running code designed to hack iPhones. The ultimate goal, researchers say, is to siphon funds from the crypto wallets of unsuspecting victims. The scariest part is that this could happen to any Apple customer, regardless of how careful they are online.
The revelation arrives at a moment when the online advertising ecosystem is increasingly being weaponized by attackers. Just a week earlier, surveillance researchers at Citizen Lab reported seeing similar tactics used to install government-grade spyware on the Windows computers of Al Jazeera journalists. In that case, the spies allegedly worked with ad tech companies to infect their targets. Now, Cole says, cybercriminals have quietly been carrying out similar attacks on iOS phones by hacking the digital advertising ecosystem themselves. Instead of breaking into a single person’s phone through a phishing email or a malicious app, they have found a way to poison the platforms and websites that millions of ordinary people trust every day. This is a supply-chain attack, except the supply chain is not software updates or hardware components—it’s the entire system that decides which ads appear on your screen. By compromising this system, criminals can hide their exploits in plain sight. They do not need to convince you to download anything. They don’t need you to click a suspicious link. They just need to get their code placed somewhere you visit, and then wait while the code attempts to break into your phone in the background, entirely without your knowledge.
Scott Helme, CEO and founder of Report URI, the cybersecurity company that uncovered the campaign and worked with iVerify on the research, explains that the criminals used clever tricks to sneak iPhone exploits onto thousands of legitimate websites. They relied on dormant domains and dead code—abandoned or inactive pieces of the web that had been left behind and could be repurposed without raising alarms. The hackers served malware to at least 6,600 legitimate websites, which together receive around 49 million visits every month. Of those, 248 websites with approximately 8 million visitors each month are directly serving iPhone spyware, effectively acting as a delivery network for one of the most dangerous types of phone-hacking code in active circulation. The remaining websites serve something different; they redirect users to a range of spam sites. Helme says he believes the cybercriminals, whom he has dubbed the DeadTag crew, are actually selling other criminals the opportunity to serve whatever malicious content they want to unwitting people visiting these sites. It is a disturbing business model, built on compromised trust. The crew is so active that they are setting up as many as ten new domains every week to stay one step ahead of takedown efforts. Helme says his company is trying to disclose the issue to all the infected sites, but the sheer number of them makes the process painfully slow. He is now approaching national cybersecurity bodies to coordinate a more effective response, because one security firm alone simply cannot keep up with an operation of this size.
One of DeadTag’s customers, Helme says, is a group dedicated to breaking into iPhones using two separate “exploit kits” that are believed to have leaked from nation state intelligence agencies. These kits were originally developed by highly skilled government hackers to break into iPhones, and their loss or release into the wild has given criminal groups the kind of powerful tools that were once unimaginable outside classified programs. Cybercriminals have been using these kits since the spring, and they have already caused real damage by stealing money from crypto wallets. Apple has patched some of the vulnerabilities the exploit kits rely on in previous attacks, which means the hackers cannot break into every iPhone. But that doesn’t mean they are out of luck. Instead, they are purposefully selecting targets who haven’t updated their devices. People who ignore iOS update reminders, who put off rebooting for a few days, or who are simply unaware that a patch exists are exactly who the attackers want to find. More worrying still, Helme found evidence in the hackers’ code that they were ready to swap in new exploits for newer, unpatched vulnerabilities in iOS. In other words, this is not a static threat. The criminals are actively preparing for the next generation of attacks, and they are watching for any opening they can find in Apple’s defenses.
The origins of the DeadTag hackers and their customers remain unclear. Neither Cole nor Helme were confident in offering a firm attribution, though they did note that the hackers’ code was written in Chinese. Forbes also found evidence that a range of domains used by the hackers were relying on a China-based web security service to protect themselves from cyberattacks. That detail might point toward a Chinese-speaking criminal group, but in the world of online attacks, such clues can all too easily be planted or simply misleading. A group with enough skill to break into the ad ecosystem and deploy leaked government tools would certainly know how to cover its tracks. The lack of clarity is itself a warning: these attackers are professional enough to avoid leaving simple fingerprints, and they are operating in the gray spaces of a digital world that is still not properly policed. Neither Apple nor Meta had responded to a request for comment at the time of publication, leaving gaps in the public understanding of the campaign. But for victims, the question of who is behind the attack matters less than the fact that it happened. Ordinary people, just by scrolling through their social media feeds, were exposed to a threat they had no reason to expect and no visible way to avoid.
At the heart of this story is a deeply uncomfortable truth: the ad-powered internet that people rely on daily has become an attack surface that few fully understand. The criminals are not breaking into homes or cracking safes. They are slipping through the same door that an advertiser uses to show you a coupon, except they have transformed that door into a hidden entrance for spyware. The best defense for individuals remains simple, even if it sounds outdated: update your phone as soon as updates become available, restart often, and be cautious about what you load in your browser. But individual caution can only go so far, because as this campaign shows, even legitimate websites can be quietly turned into weapons. This is a coordinated, industrial-scale problem that demands attention from security researchers, advertising networks, tech giants, and national cyber agencies. The discovery of the DeadTag crew’s operation is not just a warning about crypto wallet theft or iPhone spyware. It is a reminder that everyone is only as safe as the least trustworthy link in the digital advertising chain. Until that chain is made secure, the simple act of scrolling through a feed, with no clicks, no taps, and no mistakes, may carry a hidden price.
