Hackers Use Spyware to Infect 6,600 Websites
Criminal groups are exploiting expired domains and leaked toolkits to compromise thousands of websites and infect mobile devices.
Updated on Oct. 24, 2026 in Cybersecurity
Live Poll
Do you trust that your smartphone is secure from spyware attacks even without clicking suspicious links?
Attackers have infected 6,600 websites with malicious code designed to compromise iPhones and steal sensitive user data. The hackers utilize expired domains and leaked state-level spyware toolkits to target visitors.
Why it matters
The campaign exploits unpatched iOS vulnerabilities and ad targeting features to identify and strike vulnerable devices automatically. By hijacking thousands of websites, criminals can harvest cryptocurrency wallets and login credentials from unsuspecting users.
The malicious infrastructure relies on approximately 630 expired domains, allowing attackers to hijack 8,000 websites that previously utilized those domains for chatbots and analytics. The code identifies the victim's OS to deploy specific attack toolkits.
The players
DeadTag
This criminal group is suspected of selling access to thousands of websites compromised by malicious spyware-distributing code.
Citizen Lab
Based in Toronto, this research facility monitors global cybersecurity threats and investigations into state-level spyware toolkits.
Apple
The technology company provides security fixes that attackers attempt to bypass by targeting unpatched flaws in the iOS operating system.
The details
Attackers leverage ad targeting features to ensure the malicious code only triggers on vulnerable devices, such as infecting an iPhone after a user scrolls past an advertisement on Instagram. The suspected criminal group DeadTag is reportedly selling access to these compromised sites to facilitate further data theft.
Timeline
Criminals have utilized the leaked attack toolkits since spring 2026.
Citizen Lab reported a separate Windows PC attack via ads on October 15, 2026.
Researchers published findings detailing the spyware network on October 22, 2026.
The Tech Race
This campaign follows the pattern established by the 2026 Citizen Lab Windows PC advertisement attack report, marking a shift toward sophisticated mobile-centric intrusions. It highlights an ongoing arms race between developers patching unpatched iOS flaws and criminals deploying leaked toolkits.
Users may face high risks of data theft if they visit compromised websites, as malicious code can target login credentials and cryptocurrency wallets automatically. The infection process is silent, requiring no user interaction beyond scrolling past an advertisement on an affected site.
The takeaway
Security experts advise users to keep their operating systems updated to the latest versions to protect against known vulnerabilities. Practicing caution when clicking on advertisements or interacting with third-party web content can reduce the risk of accidental exposure to malicious scripts.
Further reading
For more information on current digital threats, visit the Cybersecurity section.
Live Poll
Do you trust that your smartphone is secure from spyware attacks even without clicking suspicious links?
