Hello xundeenergie,
When I first read your initial post, my though was "technically, this cannot be possible".
But after searching a bit on the internet, it looks to me as if not your wife's phone was compromised (nor is the browser), but she landed on a fraudulent website that uses so called "Clickjacking".
Apparently these companies abuse the option to buy additional services on your mobile phone by getting charged on your monthly mobile phone bill.
As you are from Austria, maybe this link is of interest for you:
https://www.verbraucherzentrale.de/wissen/digitale-welt/mobilfunk-und-festnetz/drittanbietersperre-schutz-vor-ungewollten-abos-12613
Normally, if such a company (in German they are called "Drittanbieter", not sure whether in English you call it "3rd Party provider" or something like that?) want to sell you something by charging your mobile phone bill, they explicitly have to ask you for your consent ("are you sure?").
What apparently happens is, that they camouflage the window "click here for useless subscription for insane amount" with an overlay, that may for instance look exactly like a utube video playback window. As the feedback dialogue ("are you sure"?) may be suppressed, by clicking twice (because the video playback did not start for obvious reason) you already have "signed a contract" without noticing it.
Interestingly, many of the subscriptions offered by those questionable companies, ccording to the Internet basically are useless as they do not offer any value added service that is worth it. So it seems their primary goal is to get other people's money.
I have to thank you for sharing this topic. I logged into my Mobile provider account and checked the section "Drittanbieter" (3rd party payment provider) and now have disabled (almost) all of them. At T-Mobile you can blacklist them all, whitelist some specifically or check for every 3rd party payment provider individually. In case of doubt, disabling this service in general seems a good idea to me. Looking at the long, long list of these companies over there brings me to the impression, that this is still a sort of lucrative backdoor at many mobile provider.
If anyone has further/different information feel free to share. To me it looks as if fraudulent 3rd party payments still are a thing in nowadays.