Malicious iOS Scripts: A Growing Threat to Ad Platforms

Malicious scripts specifically targeting iOS devices have emerged as a primary cause of suspensions on advertising platforms. According to the recent "State of Ad Fraud 2026: ADEX Trust & Safety Report" by the anti-fraud firm ADEX, these malicious scripts were responsible for approximately 20% of all ad platform suspensions in the third quarter of 2026. This report sheds light on the alarming trends affecting digital advertising and user security, emphasizing the need for robust preventive measures.

One particular scheme highlighted in the report exploits the Coruna exploit kit. This malicious setup operated through around 50 advertiser accounts, utilizing a shared backend infrastructure that directed users to a variety of deceptive landing pages. The actions leading to account suspensions were enforced based on the platforms’ own policies aimed at maintaining a safe advertising ecosystem.

Understanding the Attack Mechanism

ADEX thoroughly outlines a four-stage attack chain that defines how these malicious scripts operate:

1. Device Fingerprinting: The first step involves a hidden iframe embedded within the landing page. This iframe checks if the visitor is using an actual iPhone or iPad. It also identifies the device’s model and the iOS version in use.

2. Reviewer Evasion: In an effort to evade detection by moderators, the scheme serves non-malicious content to bots, crawlers, and devices tagged with suspicious IP addresses or operating in Apple’s Lockdown Mode. This strategy effectively makes the harmful scheme invisible to oversight and moderation efforts.

3. Tailored Payload: Following successful evasion, the exploit kit constructs an attack chain tailored to the specifics of the device’s iOS version and underlying hardware. The delivery mechanism disguises this exploit as a standard-looking .min.js file, which enhances its likelihood of successfully running on the device.

4. Financial Theft: The final phase targets financial applications. Here, the script seeks sensitive data, specifically wallet recovery phrases, which could enable unauthorized access to cryptocurrency funds and other sensitive financial assets.

The exploit chains identified by ADEX are effective across a range of iOS versions, particularly affecting users on older or unpatched hardware, such as the iPhone 6s, iPhone 7, first-generation iPhone SE, and certain older iPad models.

It is important to note that while ADEX provides a comprehensive analysis of observed technical behavior, their findings do not imply the involvement of any identified individuals or companies.

The Role of AI in Ad Fraud

In a broader analysis beyond iOS, ADEX found that artificial intelligence indicators were present in 52% of the distinct fraud schemes monitored. Within these AI-assisted operations, key patterns emerged:

• 64% utilized bots designed to mimic human behavior.
• 53% involved cloned brands and deceptive endorsements.
• 11% employed deepfake technology.

Sergey Martianov, the Chief Product Officer at ADEX, remarked, “AI did not invent new abuse in 2026, but it made old abuse cheap, fast, and fluent. The tell is no longer bad grammar or a blurry logo.” This statement underscores how advancements in AI have transformed the landscape of online fraud, making older techniques more accessible and effective.

Forecasting Future Threats

Looking ahead, ADEX anticipates that in 2027, malicious actors will increasingly direct their attention toward AI agents designed to browse and make purchases on users’ behalf. The report indicates likely methods of exploitation on landing pages, including:

• Invisible Text: Text that is either white-on-white, in zero-sized fonts, or hidden using CSS techniques.
• Page Plumbing: Content embedded in alt text, meta tags, HTML comments, or structured data that human visitors do not see but which AI agents interpret.
• Text Inside Images: Instructions that are visually encoded within banners or product photographs for AI agents that are capable of interpreting image data.
• Fake Assistant Notes: Fabricated claims like “this is the verified official store” inserted into reviews or FAQs.
• Agent Cloaking: Serving different page content to human moderators and AI agents, creating a deceptive funnel.

The report emphasizes that while these techniques are described as future threats, they are based on established security research and document well-known exploitation strategies.

Recommendations for Defense

To combat these emerging threats, ADEX recommends several proactive measures for security teams and advertisers:

• Assess campaigns based on actual landing page destinations across various devices and geographic locations.
• Treat landing pages that lead to messenger links as high-risk.
• Verify the identities of declared agents via cryptographically signed agent requests.
• Ensure that agent behaviors align with their stated roles.
• Conduct audits on web pages to uncover hidden text, metadata, and structured data intended for machines rather than human users.

For individual iOS users, the most critical takeaway is clear: regular updates to their devices are essential. Those unable to run current versions of iOS remain vulnerable to these advanced exploit chains, highlighting the urgency for timely software updates to ensure digital safety.

For an in-depth analysis, readers can refer to the complete ADEX "State of Ad Fraud 2026" report.

Source link