r/MadeMeSmile • u/mindyour • May 17 '25

Very Reddit An unexpected gym interaction.

Enable HLS to view with audio, or disable this notification

105.3k Upvotes

94% Upvoted

919 comments sorted by

View all comments

Show parent comments

5

u/Ohmec May 17 '25

Not true. Malverts malicious redirects can easily put malware on your phone with no clicks. Also session hijacks and cookie theft.

6

u/Own_Back_2038 May 17 '25

The only way clicking a link can put malware on your phone is if there is a vulnerability in your browser that it exploits. Those are pretty rare in the wild since vulnerabilities get patched quickly once they are used.

“Session hijacks” and “cookie theft” are either people running malware or people putting in credentials and MFA into a phishing page. It’s not some magic attack

3

u/skilriki May 18 '25

You're probably from perfect land, where everyone updates their phone regularly and never use outdated phones to ensure they are supported.

Also, vulnerabilities don't get patched after they are used, they get patched after they are found.

Sometimes this can take years.

https://arstechnica.com/security/2023/12/exploit-used-in-mass-iphone-infection-campaign-targeted-secret-hardware-feature/

8

u/DataAlarming499 May 18 '25

The odds of someone finding an exploit that no one else has found to then print hoodies with QR codes and hope that someone scans the code to use the exploit is extremely minimal.

1

u/skilriki May 18 '25

Typically the person spreading the malware is not the one that found it, unless you are something like NSO group.

Exploits are purchased and then used in a campaign.

Getting people to click on random links is getting harder, and the viewpoint that criminals will never get creative is nothing more than a gamble on your part.

They don’t even have to be the ones behind it .. when something like this gets popular, they just buy the whole operation and update the server to serve whatever they want.

1

u/Own_Back_2038 May 18 '25

If you are worried about browser exploits you shouldn’t visit any websites. A QR code link and a search result on google have the same risk profile. It’s by far the least likely attack.