New research from iVerify and Report URI indicates that hackers are increasingly using online advertising infrastructure to distribute spyware to iPhone users. Unlike traditional phishing attacks that require a victim to click a malicious link, these new campaigns can infect devices through legitimate websites and ad networks.

The report highlights a shift in the cybercrime landscape, noting that sophisticated surveillance software—once primarily used by state actors to monitor journalists and politicians—is now being repurposed by criminal groups. These actors are reportedly using the spyware to target cryptocurrency assets and sensitive login credentials.

According to the researchers, these campaigns have suspected ties to groups in China. The findings suggest that the barrier to entry for deploying advanced mobile spyware is lowering, as attackers leverage existing advertising ecosystems to reach broader audiences. While the report identifies the mechanism of the attack, it emphasizes that the primary motivation for these specific criminal groups appears to be financial gain rather than political espionage. The researchers warn that this evolution in tactics makes it significantly harder for everyday users to protect their devices, as the infection process occurs in the background of normal web browsing.