Hackers are turning web browsing into a spyware trap

Hackers are finding new ways to infect iPhones with spyware — even when victims never click a malicious link — according to new research shared with Axios.Why it matters: Software once used to spy on politicians, journalists and other high-value targets is becoming a tool for everyday cybercriminals looking to steal cryptocurrency and login credentials.Driving the news: Researchers at iVerify and Report URI said Thursday they've uncovered two campaigns in which criminal groups with suspected ties to China exploited online advertising infrastructure and legitimate websites to deliver iPhone spyware.In one case, iVerify found that a financial institution employee's iPhone was infected after they scrolled past a professional soccer advertisement on Instagram. The ad automatically triggered an attack that stole the person's login credentials and searched their cryptocurrency wallets.In another, Report URI uncovered a campaign affecting nearly 8,000 legitimate websites after hackers purchased roughly 630 expired domains that those sites still relied on. The attackers used those domains to redirect vulnerable iPhone visitors toward spyware designed to steal their credentials and cryptoc…

≈