Изследователи от Google Threat Intelligence Group, Lookout и iVerify са открили експлойта DarkSword – инструментариум, който използва верига от шест уязвимости в iOS, включително в Safari и системния софтуер, позволявайки на атакуващите да изпълняват зловреден код директно през браузъра, без да принуждават жертвата да изтегля файлове или да иска разрешения. Един документиран случай е свързан със собственичка на iPhone 15, която е била на почивка на Малдивите. Жената е гледала видеоклип на уебсайт за възрастни, когато случайно е кликнала върху рекламен банер, което е довело до автоматичното отваряне на връзка към трета страна в Safari.

Combined research between Report URI and iVerify has uncovered an extensive ecosystem being used to deliver two of the most capable iOS exploit kits ever seen, Coruna and DarkSword. Over the last month, our respective security teams have been tracking this proliferation, Report URI from the web d…

Combined research between Report URI and iVerify has uncovered an extensive ecosystem being used to deliver two of the most capable iOS exploit kits ever seen, Coruna and DarkSword. Over the last month, our respective security teams have been tracking this proliferation, Report URI from the web delivery side and

iPhoneユーザーが、Instagramの広告をスクロールして通り過ぎただけで、何もクリックしていないのにスパイウェアに感染したと報じられています。モバイルセキュリティ企業のiVerifyとWebサイトセキュリティ企業のReport URIの研究者らは、通常のWebブラウジングを支える基盤を悪用し、脆弱なiPho

Combined research between Report URI and iVerify has uncovered an extensive ecosystem being used to deliver two of the most capable iOS exploit kits ever seen, Coruna and DarkSword. Over the last mont...

月間数千万件のアクセスがある数百のウェブサイトが、運営者の知らない間にiPhone向けスパイウェアの「配信網」に組み込まれていると、セキュリティー専門家が警告している。 ■不正な広告や侵害ページを見るだけで、iPhoneが攻撃を受ける 暗号資産を盗み取ろうとする犯罪者が、iPhone利用者を大規模に狙っている。セキュリティー専門家によると、不正広告を見たり、侵害されたウェブページを開いたりするだけで攻撃を受ける仕組みだ。数百のウェブサイトが侵害され、インスタグラム上でも不正プログラム（マルウェア）を配信する広告が表示された事例がある。 モバイルセキュリティー企業iVerifyの共同創業者兼最高執行責任者（COO）、ロッキー・コールは、攻撃の特徴を次のように説明する。「利用者は悪質なサイトを訪れているわけではない。何も悪いことをしていない。ただ画面をスクロールしているだけで感染している」。 https://news.yahoo.co.jp/articles/d2d3e0d241e176c9152a033d0a6da02d4130909b

Hackers are finding new ways to infect iPhones with spyware — even when victims never click a malicious link — according to new research shared with Axios. Why it matters: Software once used to spy on politicians, journalists and other high-value targets is becoming a tool for everyday cybercriminals looking to steal cryptocurrency and login credentials. Driving the news: Researchers at iVerify and Report URI said Thursday they've uncovered two campaigns in which criminal groups with suspected ties to China exploited online advertising infrastructure and legitimate websites to deliver iPhone spyware. In one case, iVerify found that a financial institution employee's iPhone was infected after they scrolled past a professional soccer advertisement on Instagram. The ad automatically triggered an attack that stole the person's login credentials and searched their cryptocurrency wallets. In another, Report URI uncovered a campaign affecting nearly 8,000 legitimate websites after hackers purchased roughly 630 expired domains that those sites still relied on. The attackers used those domains to redirect vulnerable iPhone visitors toward spyware designed to steal their credentials and cryptocurrency. How it works: Both campaigns exploited tools that load automatically as people browse the internet, eliminating the need to trick victims into clicking malicious links. In the iVerify case, malicious code began running as soon as the Instagram advertisement appeared on the victim's screen. The attack checked the iPhone's operating system before deploying a compatible exploit. In the Report URI campaign, attackers purchased expired domains once used to host legitimate website features, such as chatbots and analytics tools. Thousands of websites were still loading code from those domains, allowing criminals to quietly redirect visitors toward malicious software. Threat level: The findings show how cybercriminals are building an infrastructure for delivering spyware through everyday online activity, rather than relying on traditional phishing attacks or targeting specific individuals. Both methods also allow attackers to selectively target vulnerable devices. Advertising platforms can narrow audiences based on interests and device characteristics, while malicious website code can identify a visitor's operating system before selecting an attack. The big picture: Cybercriminals are increasingly weaponizing spyware to exploit mobile phones, whose security (whether on an iPhone or Android) has often been seen as ironclad. Last year, iVerify uncovered evidence of the first spyware campaign targeting iPhones in the U.S. and the European Union. Last week, researchers at the University of Toronto's Citizen Lab uncovered the first public confirmation of zero-click spyware delivered via targeted ads — targeting at least 45 devices within international news network Al Jazeera. Rocky Cole, co-founder and chief operating officer at iVerify, told Axios that spyware is now "the fastest proliferating threat to mobile devices at the current moment." The intrigue : "They're either Chinese or they definitely want us to think that they are," Scott Helme, founder and CEO at Report URI, told Axios about the groups behind the campaigns. What to watch: Researchers warn that the growing availability of sophisticated spyware is forcing consumers to rethink how they protect their phones. Cole and Helme both emphasized keeping mobile operating systems updated, since the attacks depend on exploiting vulnerabilities in specific software versions.

セキュリティ企業iVerifyは、iPhone上でパスワード、仮想通貨ウォレット、個人写真の窃盗を専門とする危険なマルウェア「P7 DarkSword」を発見した。

Discover P7 DarkSword, a new iOS spyware variant with improved stealth, keychain and crypto-wallet theft, and two-way C2 communication.

<p>La empresa de seguridad móvil iVerify ha publicado detalles técnicos sobre P7 DarkSword, una nueva variante del kit de explotación para iOS que añade capacidades de comunicación bidireccional y rob...

iPhoneへの感染により、DarkSwordの運用者は一度きりのファイル窃取にとどまらない攻撃を仕掛けられるようになりました。新たに確認された亜種は、Appleのキーチェーンや暗号資産ウォレットのデータを抽出できるうえ、攻撃者から新たな命令を受け取ることもできます。モバイルセキュリティ企業のiVerifyは1

تنقل نايلة الصليبي في"النشرة الرقمية" تقارير شركتي أمن المعلومات والأمن السيبراني  Bitdefender و iVerify عن برمجيات خبيثة تستهدف أجهزة الأيفون والأندرويد، لسرقة بيانات المستخدمين ومحافظ العملات المشفرة ،وتحويل الأجهزة الملوثة إلى بروكسي منزلي يتيح استغلال اتصال الضحية لتحقيق مكاسب مالية أو إخفاء مصدر أنشطة مشبوهة، فضلًا عن إمكانية استخدام الأجهزة في هجمات حجب الخدمة الموزعة.

Bezpečnostní firma iVerify popsala novou variantu spywaru DarkSword, která z iPhonů se starším iOS krade data z Klíčenky i kryptoměnových peněženek. Šíří se přes škodlivé reklamy, takže nemíří jen na vybrané cíle. Proti známým dírám přitom stačí aktualizace, kterou Apple od 8. října nabízí výrazněji než dřív. Vysvětlujeme, koho se útoky týkají a co nastavit.

Siber güvenlik şirketi iVerify, iPhone’ları hedef alan DarkSword casus yazılımının "P7" adı verilen yeni bir varyantını keşfetti.

Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword. "Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keychain and crypto-wallet theft, and adds two way C2 communication with the attacker's infrastructure," iVerify said in a new report published Thursday. The name

Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword. "Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keychain and crypto-wallet theft, and adds two way C2 communication with the attacker's infrastructure," iVerify said in a new report published Thursday. The name

iVerify hat einen Bericht zu P7 DarkSword veröffentlicht, einer neuen Variante der Schadsoftware aus der iPhone-Exploit-Kette DarkSword. ...