iPhone users targeted by zero-click spyware attacks

New cybersecurity research reveals that iPhone users are being targeted by sophisticated zero-click spyware attacks that do not require any interaction, such as clicking a link, to infect a device.

In one instance identified by iVerify, a financial institution employee was targeted via an Instagram advertisement for a professional football club. The malicious code automatically activated, stealing login credentials and scanning cryptocurrency wallets.

A separate campaign identified by Report URI involved attackers purchasing approximately 630 expired domains that were previously used by legitimate websites. Because these domains were still integrated into the infrastructure of thousands of sites for services like live chat and analytics, roughly 8,000 websites were found to be inadvertently directing visitors to malicious malware infrastructure.