Zero-Click Exploits Target Mobile Crypto Wallets

Cybercriminals have launched an extensive operation targeting Apple smartphone users, deploying sophisticated malware to drain cryptocurrency wallets. The campaign compromises legitimate websites through abandoned tracking infrastructure, allowing hackers to install invasive spyware on consumer devices without requiring the victim to download files or interact with malicious links.

According to mobile security researchers, millions of web users face potential exposure merely by viewing everyday internet pages or scrolling past compromised advertisements. The operation bypasses standard cybersecurity warnings by exploiting expired domains and neglected analytical tags that remain embedded in otherwise safe websites.

Repurposing Expired Infrastructure

The group orchestrating the campaign is tracked by security analysts as the DeadTag crew. The syndicate systematically locates unmaintained script references and purchases expired domains. By inserting their own servers into these dormant pathways, the crew has constructed a marketplace for automated cybercrime.

DeadTag registers up to 10 new domains every week. The group does not typically execute the thefts directly; instead, they sell access to secondary hacking outfits looking for a direct route into consumer hardware. The primary objective of these buyers is to siphon digital assets stored in mobile wallets on the targeted handsets.

The reach of this distribution network extends far beyond the dark web. Cybersecurity specialist Scott Helme, founder of the firm Report URI, discovered the malicious code operating across a minimum of 6,600 legitimate websites. Collectively, these compromised platforms draw 49 million monthly visits.

Within that total, researchers identified 248 mainstream destinations that function as an active delivery pipeline for the malicious iOS payloads. These high-traffic sites attract roughly eight million visits per month. In one instance, the rogue advertising code successfully loaded directly within users' social media feeds on Instagram.

Leaked Intelligence Exploits

The software delivered to victims goes far beyond typical adware. Analysts discovered that purchasers on the DeadTag network are utilizing two advanced exploit kits, known as Coruna and DarkSword. Researchers widely believe these tools leaked from state-level intelligence agencies, where they were once reserved for elite espionage before entering the commercial cybercrime market.

These leaked exploits are actively used to compromise Apple devices, specifically hunting for victims who are running older, unpatched builds of the iOS operating system. Forensic examinations of the command scripts revealed code written in Chinese. Furthermore, the malicious domains are routed through Chinese internet security infrastructure in an effort to deflect defensive countermeasures.

Rocky Cole, chief executive and co-founder of mobile security company iVerify, highlighted the severe risk posed by the drive-by infections.

“Users aren’t visiting malicious websites. They’re not doing anything wrong. They’re just scrolling and being infected,” Cole noted.

Because standard social engineering tactics are entirely absent, traditional web browsing caution is insufficient to protect consumer funds. Helme is currently coordinating with national cybersecurity organizations to accelerate the takedown of the malicious infrastructure, though the massive volume of compromised domains makes the notification process exceptionally complex. Security analysts urge individuals holding digital assets on mobile devices to treat system updates as critical financial maintenance.