Possible malware or phishing

So i consider myself an educated apple user. I have "mastered" the devices since 2008 and know abut dfu modes soft/hard reboots and the likes. This however is probably the first time ever when i seek help on these devices. It was two nights ago when i was using my phone and tablet when suddenly one after the other they rebooted. This is not something that happens often or ever for that matter since i take care of them. Both devices are not jailbroken but seem to have been hacked.


The Problem:


Every now and then when i am using a browser when opening a link or URL i get sent to this:

User uploaded file

It has happened with Facebook, Messenger, Safari, Mozilla Firefox. I have tried clearing the browsing data, logs, cookies and rebooting the phone after. Deleting the programs also did not solve the problem. The problem continues even when not on wifi. I assume the iPad2 is in the same boat, but i use my iPhone 6 plus more so i get more of this there. I tried numerous protection apps from the app store, but nothing worked so far.


Sorry if i made the post inaccurate or in some way as it should not be, but its 1:16 am and i have no idea what is causing this and how to fix it.

iPhone 6 Plus, iOS 9.2

Posted on Jan 5, 2016 3:18 PM

Reply
14 replies

Jan 5, 2016 3:29 PM in response to ckuan

So the random simultaneous iphone and ipad restart were not from malware injection? I got redirected from a very normal website that doesn't even have visitors that are that well computer orientated, yet i find it hard to believe that they would have such scamy ads.


This has happened more times in the past days than random popups have ever. And the links have nothing in common between them.

Jan 5, 2016 3:57 PM in response to Angelhubev

Is the phone jailbroken? If yes, then all bets are off when using software that has not been vetted by the App Store. Not that the occasional bad app gets in, but it's rare.


It's also possible your router has been hacked, and the redirects are coming from there. All routers have some way of resetting them to factory condition. Usually a small button you hold in for several seconds. Consult the manual for your device for the correct procedure. This of course doesn't apply at all if it happens anywhere you are with your phone.

Jan 5, 2016 4:06 PM in response to Angelhubev

There's nothing to fix, and you can't fix someone else websites, you've to stop visiting those sites.

And if you care, write them about it.


As for you, make a local backup and then restore the device as new and test.

If it's working, restore from the backup and test again.

If it start happening again, it has something to do with the backup.

Restore as new again and manually sync back the stuff you want.

Jan 5, 2016 6:16 PM in response to Kurt Lang

It seems i have stumbled across the legendary onclickad.net malware/virus. From what my till 4am reading has led me to understand is that i injects itself into browsers, modifies host files and spreads. It's able to modify the router's DNS settings and ios handheld devises are not immune to it. This is very disturbing as i do not want to relinquish my photos to some spammy ad redirecting site. However i think everything is infected. Earlier today even my steam account opened a link to that site it pops open to from my mac. I do use adblock on Safari so i didn't notice it here like i did on my ipad and iphone. But people say that its highly possible to have infected my router by now. Looks like i am forced to clean install everything in my house unless we find a solution.


Just checked. It has infected my grandma's ipad air as well. She is incapable of getting apps and other than Facebook and skype doesn't use the device...

Jan 6, 2016 6:37 AM in response to Angelhubev

This shouldn't be possible on an iOS device. Which isn't the same as saying impossible. But the OS and the installed apps are supposed to be completely locked down against any kind of injection or other modifications. Which is what System Integrity Protection is for in El Capitan.


I'll see if I can get Thomas Reed to look at your topic. He's an actual malware expert for the Mac platform.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Possible malware or phishing

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.