- Researchers found a campaign called DeadTag that abuses abandoned ad and analytics domains to send visitors to harmful content.
- Report URI and iVerify linked the bad code to at least 6,600 real websites, and 248 sites reportedly spread iPhone spyware directly.
- The attacks target iPhones without the latest security fixes, and they go after passwords and cryptocurrency wallet data.
Thousands of real websites have been pulled into a new cybercrime campaign. It can expose weak iPhones to spyware. Users do not need to click a link or download an app. Researchers call the campaign DeadTag. It abuses abandoned advertising and analytics domains to push harmful content to chosen visitors.
Cybersecurity firms Report URI and iVerify shared their joint investigation on October 21, 2026. Their report describes a system that turns forgotten website code into a delivery network. That network spreads advanced iPhone attacks through parts of the online advertising world. Two separate security teams worked on the findings, so the report carries input from both companies.
Attackers Buy Expired Domains to Reach Visitors
A tag is a small piece of code on a website. It loads content from another service, such as ads or visitor counters. According to Report URI founder Scott Helme, attackers bought expired domain names. Ad networks, analytics services and other outside tools once used those names. Website owners never removed the matching tags from their pages. The original services later disappeared. The tags stayed behind.
Attackers now control those domains. The old tags can load resources that criminals own. The attackers can then spot selected visitors. They send those visitors to fake pages or attack servers. The process works in three steps. First, the old tag loads. Next, the attackers pick their targets. Finally, the harmful content arrives.
The researchers found at least 6,600 real websites carrying code linked to the operation. Together, these sites get about 49 million visits each month. Of these, 248 sites reportedly spread iPhone spyware directly. Those 248 sites draw around eight million monthly visits.
The team also found harmful code on hundreds of online shops. These shops run on the PrestaShop e-commerce platform. Researchers reported one more case. An Instagram ad appeared to deliver a harmful file to an iVerify employee. The employee was only scrolling through the platform. This shows the threat can also reach people through social platforms, not only through websites.
These findings do not mean every visitor gets infected. The result depends on the device, its software version and the exact content delivered. In a separate campaign, Russian-linked hackers exploited a flaw in Zimbra email software to conduct espionage, highlighting how attackers also abuse trusted online services to reach their targets.
Coruna and DarkSword Kits Go After Passwords and Crypto
The campaign uses two advanced attack kits, called Coruna and DarkSword. An exploit kit is a bundle of tools that abuse software flaws. Both kits can target weak spots in Apple’s mobile system.
The researchers found that the tools can reach passwords stored in the iPhone Keychain. The Keychain is Apple’s built-in place for saved passwords. They can also grab device data and cryptocurrency wallet details. Wallet apps hold a person’s cryptocurrency. The targeted wallet apps include Binance, Coinbase Wallet, Trust Wallet, Exodus and OKX. Others are on the list as well. The stolen details could help attackers break into accounts or steal cryptocurrency.
Some attacks traced back to a fake Polymarket page. Its design triggers the exploit through the browser. On a weak phone, loading the page can start the attack. The user needs no extra download or click.
Nobody knows for sure who runs DeadTag. Report URI said it could not name the operators with confidence. A separate group uses the attack kits. That group appears to speak Chinese, based on Chinese code comments and other technical clues. These hints do not prove the attackers’ nationality.
It is also wrong to say the US National Security Agency definitely built Coruna. Google’s Threat Intelligence Group documented Coruna across several campaigns. It linked that activity to different threat actors. Its research does not show that the NSA wrote the kit.
Apple Has Released Fixes, So Updates Matter Most
Apple has addressed the flaws that Coruna and DarkSword used. It delivered the fixes through software updates. Google’s March 2026 research said Coruna targeted iOS versions 13.0 through 17.2.1. It said DarkSword targeted versions 18.4 through 18.7. Phones on those versions were the ones the kits aimed at.
Apple also released security updates for older supported devices. Its support pages (first page, second page) list the details.
Users should install the newest iOS version available for their iPhone. They can open Settings, then General, then Software Update. Owners of older phones should look for the latest update that fits their model. They should not assume their phones are already safe. Updating also matters for owners of older devices, since Apple released separate fixes for them.
The findings point to a wider problem. Even real websites and familiar social platforms can expose users to harmful content. Compromised ad systems and neglected outside code make this possible. Keeping devices updated remains one of the best ways to lower the risk.
Share this article
About the Author
Rebecca James is an IT consultant with forward thinking approach toward developing IT infrastructures of SMEs. She writes to engage with individuals and raise awareness of digital security, privacy, and better IT infrastructure.
More from Rebecca JamesRelated Posts
PHP Warns of New Potential RCE Flaw, Recommends Disabling Upload Progress
PHP has disclosed CVE-2026-115560, a possible remote code execution flaw that affects apps with an u...
Google and Other Tech Giants Block eMudhra Certificates After Weak Keys Exposed
Researchers cracked eight very weak secret keys tied to Indian certificate company eMudhra within se...
Microsoft Admits Windows 11 October Updates Failed to Fix Always On VPN Bug
Microsoft says its October 2026 Windows 11 updates did not fix the Always On VPN connection bug. The...
Canva Confirms Salesforce Data Exposure via Canny as Hackers Claim Millions of Records
Canva says hackers got into Canny, a tool it used for product feedback, and accessed some business c...
Phonelyne Faces Unverified Data Leak Claim Involving eSIM Codes and API Keys
A hacker called DaOnlySpark claims to hold customer, payment, and eSIM records tied to Phonelyne. Th...
BeyondTrust Remote Support Zero-Day Exploited by China-Linked Hackers
Google and Mandiant say a suspected China-linked group, Armory Castle, used the flaw before the publ...
