iVerify and Report URI investigated malicious advertising and compromised web infrastructure delivering Coruna and DarkSword exploits to vulnerable iPhones. The reported payloads targeted crypto-wallet data, creating a direct Crypto security development. Citizen Lab’s AdFection/Candiru investigation describes a separate surveillance operation. ABC reported that it was targeted but had found no evidence that its systems were compromised; the cited reports do not establish crypto theft from ABC, Al Jazeera or ANSTO.
Zero-click iPhone spyware attacks
- ▪Citizen Lab researchers confirmed zero-click spyware delivered through targeted online ads infected at least 45 devices at international news network Al Jazeera.
- ▪Cybersecurity executives Rocky Cole of iVerify and Scott Helme of Report URI advised mobile users to maintain updated operating systems to block zero-click attacks targeting software vulnerabilities.
- ▪Cybersecurity firms iVerify and Report URI identified two cyber campaigns delivering spyware to Apple iPhones through online advertisements and compromised websites without requiring user clicks.
- ▪In one attack identified by iVerify, a financial institution employee's iPhone was infected with spyware after the user scrolled past a professional soccer advertisement on Instagram.
Malicious advertising infrastructure exploitation
- ▪The DeadTag campaign exploited dormant web domains and leftover code from chatbots and analytics tools to identify visitor operating systems and deploy iPhone exploits.
- ▪Report URI founder Scott Helme reported that 248 compromised websites with 8 million monthly visitors directly served iPhone spyware as part of the DeadTag campaign.
- ▪The DeadTag cyberattack campaign utilized two iPhone exploit kits believed to have leaked from nation-state intelligence agencies.
- ▪Report URI discovered that cybercriminals behind the DeadTag campaign registered up to 10 new malicious web domains every week to expand their delivery network.
- ▪Hackers in the DeadTag campaign purchased roughly 630 expired web domains still relied on by nearly 8,000 legitimate websites to deliver spyware to iPhone visitors.
Cryptocurrency wallet theft targeting
- ▪Cybercriminals deployed zero-click malvertising and compromised web domains primarily to siphon funds from cryptocurrency wallets and steal user authentication credentials.
- ▪The Instagram zero-click spyware attack automatically searched the infected financial institution employee's cryptocurrency wallets and extracted their personal login credentials.
Adfection campaign targeting organizations
- ▪The Adfection campaign involved Israeli firm Discover-Tech exploiting digital advertising networks to deliver zero-click spyware developed by Israeli surveillance vendor Candiru.
- ▪Citizen Lab revealed that an ad-based cyber campaign named Adfection targeted over two dozen Australian government, critical infrastructure, university, and media organizations.
- ▪Citizen Lab researchers identified Australia's nuclear science agency ANSTO as a major hotspot for malicious advertisement impressions during the Adfection cyber campaign.
ABC device security response
- ▪The Australian Broadcasting Corporation confirmed that a small number of its organizational devices were exposed to malicious online ad networks associated with the Adfection campaign.
- ▪The Australian Broadcasting Corporation initiated precautionary device wiping for all exposed staff devices in service, reporting no evidence of system compromise or tracking.
Story comments
Loading comments…