Imagine you’re waiting for a bus, scrolling through Instagram, half-noticing an ad for a pair of sneakers. It looks ordinary, maybe even boring. You don’t click. You don’t download anything. You just keep scrolling. Yet according to cybersecurity researchers, that casual glance may be enough to give criminals access to an iPhone and drain a cryptocurrency wallet. This is not a hypothetical warning; it is a real, active campaign that researchers tell Forbes is targeting Apple users at scale. The attack requires no bad decisions from the victim. As Rocky Cole, CEO of mobile security firm iVerify, puts it: “Users aren’t visiting malicious websites. They’re not doing anything wrong. They’re just scrolling and being infected.” The investigation began after cybersecurity expert Scott Helme found hundreds of legitimate websites running hidden code designed to attack iPhones. As he and iVerify dug deeper, they uncovered a sprawling operation. The criminals were abusing the online advertising ecosystem—the same chain of companies and code that decides which ads appear on webpages and social media feeds. In one case, a malware ad was served over Instagram. In many other cases, simply visiting an infected webpage was enough. The goal was to siphon funds from cryptocurrency wallets, not to steal identities or spy on conversations. The targets are likely people who trade or hold crypto on their phones. For them, the danger is terrifying: an attacker can empty their wallet while they are absentmindedly looking at photos and videos.
At the heart of the operation lies a technical trick that is almost invisible to ordinary users. The criminals used “dormant domains”—web addresses that look abandoned or empty—and “dead code,” hidden snippets of programming that lie quiet until the right moment. Helme, who runs the cybersecurity company Report URI, discovered that at least 6,600 legitimate websites had been compromised in this way. Those websites collectively receive about 49 million visits every month. Of those, 248 websites, with about 8 million monthly visitors, were actively serving iPhone spyware. Helme called those sites the “delivery network” for the attacks. The remaining infected websites were being redirected to a large range of spam pages. The criminals behind the campaign, whom Helme has named “DeadTag,” appear to run a service for other crooks. Instead of using all the traffic for one single attack, DeadTag sells access to infected websites, allowing other criminals to serve whatever malicious content they want to the unsuspecting visitors. That makes the problem even more complex: a single infected site can be used for phishing, scams, spyware, or anything else the buyer wants. Helme’s team has been trying to warn the thousands of site owners that their pages have been compromised, but the process is overwhelming. With as many as ten new domains being created every week to carry the rogue code, the campaign is continuously growing. Helme has begun approaching national cybersecurity agencies, hoping that a coordinated effort can accelerate disclosures before more people are robbed.
The sophistication of the attacks points to a dark intersection between state espionage and digital theft. A week before the iPhone findings were published, researchers at Citizen Lab reported that they had seen similar tactics being used to install government-grade spyware on the Windows computers of Al Jazeera journalists. In that case, spies allegedly worked with ad-tech companies to deliver the malicious code. Now the same idea has been adopted by criminals targeting iPhones. Helme says one of DeadTag’s customers is a group devoted to breaking into iPhones using two “exploit kits” believed to have leaked from nation-state intelligence agencies. These kits are extremely powerful; they were originally created to let governments bypass iPhone security for surveillance. Since spring, criminals have been using them in attacks on ordinary people. Apple has already patched the specific vulnerabilities that the exploit kits use, which means the attacks are not hitting everyone at random. They are aimed at devices that have not been updated, likely because someone ignored an update notification or is using an older phone. But Helme also found evidence in the hackers’ code that they are prepared to swap in new exploits for newer iOS vulnerabilities that Apple has not yet fixed. That suggests the people behind this campaign are not just opportunistic thieves. They are maintaining a modern arsenal, waiting for fresh holes before security teams can close them.
What makes this so unsettling is that the attack uses the same systems that make websites profitable and free to use: online advertising. For years, security advice has told people to avoid sketchy sites, not to click suspicious links, and never to enter personal information into random pop-ups. This attack bypasses all of those warnings. The infection can be triggered by a malicious ad served on a reputable website, or simply by opening a page that has been compromised. In one case, the malware ad was delivered through Instagram, one of the largest social platforms in the world. That means even a careful user can be caught. The danger is not hiding in a dark corner of the web; it is embedded in the ordinary infrastructure of browsing. When a webpage loads, it pulls in content from dozens of different sources—advertisers, tracking companies, video players, analytics tools. Each source is a potential doorway for an attacker. By hacking the ad ecosystem, criminals can hide their code in plain sight. They also use dead code and dormant domains to avoid detection: the malicious payload may only activate when the right type of device visits the page. For most people, the webpage loads normally and the phone seems fine. There is no flicker, no delay, no error message. Hidden in the background, the attack may be checking the phone’s settings, locating crypto apps, stealing private keys, or sending funds out of a wallet. The victim may not realize anything happened until they look at their balance later.
The origins of the DeadTag crew remain unclear. Neither Cole nor Helme is confident about where the hackers are based or who is buying their services. There are clues, though. The code they found was written in Chinese, and Forbes discovered that many of the domains used by the hackers were protected by a China-based web security service. The use of such services is common for criminals trying to block investigators and keep their servers online. It does not necessarily prove that the group is Chinese, but the clues will likely shape the investigation. Apple and Meta, the company that owns Instagram, did not respond to requests for comment at the time of publication. For Apple, this campaign is a reminder that even a strong security model depends on users updating their devices. For Meta, it raises questions about whether ads are screened thoroughly enough. The researchers are not claiming the tech giants are responsible for the attacks. The real problem is the complexity of the internet: at any point along the ad-serving chain, somebody can insert malicious code, and no single company can watch every pixel. The website owners are also victims. Many are small businesses, blogs, or local organizations that never imagined their pages would be turned into weapons. They now face the difficult task of cleaning up code they did not write, often without a security team to help. The disclosure process is slow, which is why Helme is trying to coordinate with national cybersecurity bodies to warn the owners of the thousands of infected sites.
For an ordinary person, especially someone who owns cryptocurrency, this should be a reason to take action immediately. The current attacks exploit known iOS vulnerabilities, which means installing Apple’s latest updates will protect against the specific methods used so far. People who delay updates, or who use iPhones too old to receive new versions, are the most exposed. It is also wise to use a hardware wallet for significant crypto savings, to avoid keeping large sums in phone-based wallets, and to use two-factor authentication wherever possible. But the deeper problem is that no amount of careful scrolling can fully protect against a poisoned ad or a compromised website. The web is not a collection of clearly marked dangerous corners. It is a network of real places, and those places can be quietly broken into. The criminals’ ability to create new domains, adapt their code, and wait for unpatched devices means the threat is not going away. The researchers who found the campaign are not celebrities; they are a small group of engineers trying to expose a system that is being used as a weapon. Their work is a reminder that the digital world requires constant attention. The person sitting on the couch scrolling through social media is not a foolish victim; they are a target. The phrase “just scrolling” has taken on a darker meaning. An update notification on your phone is no longer a minor annoyance—it may be the only thing standing between you and an empty crypto wallet. Until the ad ecosystem is cleaned up, the best defense is to be proactive: update, secure, and monitor your accounts. And maybe, when a tempting ad appears, ask yourself what is actually being sold—and who is doing the selling.
