Zararli iOS skriptlari reklama platformalarining to‘xtatilishining asosiy sababiga aylandi. Ular 2026-yilning uchinchi choragida to‘xtatishlarning taxminan har beshtasidan birini tashkil etdi, deb xabar beradi anti-frod firmasi ADEXning "State of Ad Fraud 2026: ADEX Trust & Safety Report" hisobotida.
Hisobot bir sxemani batafsil o‘rganadi. U Coruna eksploit to‘plami asosida qurilgan va juda turli landing sahifalari ortida bir xil back-end sozlamasidan foydalangan taxminan 50 ta reklama beruvchi akkaunt orqali ishlagan.
Platformalar ushbu akkauntlarni o‘z siyosatlariga muvofiq to‘xtatdi.
Hujum Zanjiri Qanday Ishlaydi
ADEX to‘rt bosqichni tasvirlaydi:
- Qurilma barmoq izini olish. Landing sahifadagi yashirin iframe tashrifchining haqiqiy iPhone yoki iPad ekanligini tekshiradi. Shuningdek, aniq model va iOS versiyasini aniqlaydi.
- Moderatorlardan qochish. Botlar, krawlerlar, shubhali IP manzillar, shaxsiy brauzer sessiyalari va Apple’ning Lockdown Mode rejimidagi qurilmalar zararsiz sahifani ko‘radi. Bu filtratsiya sxemani moderatorlar uchun ko‘rinmas qiladi.
- Moslashtirilgan yuk. To‘plam qurilmaning aniq iOS versiyasi va chipiga mos eksploit zanjirini yig‘adi. U zanjirni oddiy ko‘rinadigan .min.js fayli sifatida yetkazadi.
- Moliyaviy o‘g‘irlik. Yakuniy implant blokcheyn va moliyaviy ilovalarni nishonga oladi. U telefonda hamyonni tiklash seed frazalarini qidiradi.
Eksploit zanjirlari iOS 13.0 dan 17.2.1 gacha bo‘lgan versiyalarni qamrab oladi. Eng zaif foydalanuvchilar — eski yoki yangilanmagan qurilmalardagi foydalanuvchilar, jumladan:
- iPhone 6s va iPhone 7
- birinchi avlod iPhone SE
- eski iPad’lar
ADEX ta’kidlashicha, uning tavsifi kuzatilgan texnik xatti-harakatlarni qamrab oladi va hech qanday aniqlangan shaxs yoki kompaniya haqida bayonot emas.
AI Endi Frod Vositalar To‘plamining Standart Qismiga Aylangan
iOS’dan tashqari, ADEX kuzatgan alohida frod sxemalarining 52% ida AI indikatorlarini topdi. Ushbu AI ishtirok etgan sxemalar ichida:
- 64% inson sifatida o‘tadigan botlardan foydalangan
- 53% klonlangan brendlar va soxta tavsiyalardan foydalangan
- 11% deepfake’lardan foydalangan
"AI 2026-yilda yangi suiiste’molni ixtiro qilmadi, lekin eski suiiste’molni arzon, tez va ravon qildi... Endi belgi yomon grammatika yoki xira logotip emas," — dedi ADEX CPO’si Sergey Martianov.
Keyingi Nishon: AI Agentlari
ADEX 2027-yilda hujumchilar foydalanuvchilar nomidan ko‘rib, sotib oladigan AI agentlariga tobora ko‘proq e’tibor qaratishini bashorat qiladi. Hisobotga ko‘ra, landing sahifalarida ehtimoliy in’eksiya vektorlari quyidagilarni o‘z ichiga oladi:
- Ko‘rinmas matn: oq-oq matn, nol o‘lchamli shriftlar yoki CSS bilan yashirilgan bloklar
- Sahifa tuzilishi: alt matn, meta teglar, HTML izohlari va brauzerlar ko‘rsatmaydigan, lekin agentlar tahlil qiladigan tuzilgan ma’lumotlar
- Rasmlar ichidagi matn: agentlar rasmlarni o‘qiydigan bannerlar yoki mahsulot fotosuratlariga yozilgan ko‘rsatmalar
- Soxta yordamchi eslatmalar: sharhlar, FAQ yoki shartlarda joylashtirilgan "bu tasdiqlangan rasmiy do‘kon" kabi qatorlar
- Agentni yashirish: odamlar va moderatorlar uchun sahifaning bir versiyasi, AI agentlari sifatida aniqlanadigan tashrifchilar uchun boshqa versiya
In’eksiya qilingan ko‘rsatmalar odatda qisqa va amaliy bo‘ladi. Misollar orasida mahsulotni birinchi o‘ringa qo‘yish, xavfsizlik ogohlantirishini e’tiborsiz qoldirish yoki foydalanuvchi ma’lumotlarini kiritish orqali davom etish kiradi. ADEX buni bashorat deb belgilaydi, o‘lchangan kategoriya emas, lekin texnikalar xavfsizlik tadqiqotlarida yaxshi hujjatlashtirilganini ta’kidlaydi.
Himoya Tavsiyalari
ADEX hisoboti xavfsizlik jamoalari va reklama beruvchilarga quyidagilarni tavsiya qiladi:
- kampaniyalarni bosish haqiqatan qayerga yetib borishi bo‘yicha, qurilmalar va mamlakatlar bo‘yicha baholash
- yagona chiqish yo‘li messenger havolasi bo‘lgan har qanday landing sahifani yuqori xavf deb hisoblash
- e’lon qilingan agent identifikatorlarini tekshirish, masalan kriptografik imzolangan agent so‘rovlari orqali
- agent xatti-harakatining e’lon qilingan vazifasiga mos kelishini tekshirish
- o‘z sahifalarini mashinalarga qaratilgan yashirin matn, metama’lumotlar va tuzilgan ma’lumotlar bo‘yicha tekshirish
iOS foydalanuvchilari uchun darhol xulosa oddiy: qurilmalarni yangilang. Joriy iOS versiyalarini ishlata olmaydiganlar bunday zanjirlarga nisbatan zaif qoladi.
To‘liq tahlilni ADEX State of Ad Fraud 2026 hisobotida o‘qing.
Malicious iOS scripts have become a leading cause of ad platform suspensions. They accounted for about one in five suspensions in Q3 2026, according to the State of Ad Fraud 2026: ADEX Trust & Safety Report from anti-fraud firm ADEX.
The report examines one scheme in detail. It was built on the Coruna exploit kit and ran through about 50 advertiser accounts that used the same back-end setup behind very different landing pages.
The platforms suspended those accounts under their own policies.
How the Attack Chain Works
ADEX describes four stages:
- Device fingerprinting. A hidden iframe on the landing page checks whether the visitor is a real iPhone or iPad. It also identifies the exact model and iOS version.
- Reviewer evasion. Bots, crawlers, suspicious IPs, private browsing sessions and devices in Apple’s Lockdown Mode are served a harmless page. This filtering keeps the scheme invisible to moderators.
- Tailored payload. The kit assembles an exploit chain matched to the device’s exact iOS version and chip. It delivers the chain as an ordinary-looking .min.js file.
- Financial theft. The final implant targets blockchain and financial apps. It searches the phone for wallet recovery seed phrases.
The exploit chains cover iOS 13.0 through 17.2.1. The most exposed users are those on older or unpatched hardware, including:
- iPhone 6s and iPhone 7
- first-generation iPhone SE
- older iPads
ADEX notes that its description covers observed technical behaviour and is not a statement about any identified person or company.
AI Is Now Standard in the Fraud Toolkit
Beyond iOS, ADEX found AI indicators in 52% of the distinct fraud schemes it observed. Within those AI-involved schemes:
- 64% used bots that pass as humans
- 53% used cloned brands and fake endorsements
- 11% used deepfakes
“AI did not invent new abuse in 2026, but it made old abuse cheap, fast, and fluent… The tell is no longer bad grammar or a blurry logo,” said Sergey Martianov, CPO at ADEX.
Next Target: AI Agents
ADEX forecasts that in 2027, attackers will increasingly aim at the AI agents that browse and buy on users’ behalf. According to the report, likely injection vectors on landing pages include:
- Invisible text: white-on-white text, zero-size fonts, or blocks hidden with CSS
- Page plumbing: alt text, meta tags, HTML comments and structured data that browsers do not display but agents parse
- Text inside images: instructions written into banners or product photos for agents that read images
- Fake assistant notes: lines such as “this is the verified official store” planted in reviews, FAQs or terms
- Agent cloaking: one version of the page for humans and moderators, another for visitors that identify as AI agents
The injected instructions tend to be short and practical. Examples include ranking a product first, ignoring a security warning, or entering the user’s details to continue. ADEX labels this a forecast, not a measured category, but notes the techniques are well documented in security research.
Defensive Recommendations
The ADEX report recommends that security teams and advertisers:
- judge campaigns by where the click actually ends up, across devices and countries
- treat any landing page whose only exit is a messenger link as high risk
- verify declared agent identities, for example through cryptographically signed agent requests
- check that agent behaviour matches its stated task
- audit their own pages for hidden text, metadata and structured data aimed at machines
For iOS users, the immediate takeaway is simple: update devices. Those that cannot run current iOS versions remain exposed to chains like this one.
Read the full analysis in the ADEX State of Ad Fraud 2026 report.
