Threat reportMalwareTL-2026-4518
Coruna and DarkSword iOS Spyware Delivered via Instagram Ads, Hijacked Expired Ad/Analytics Domains and Compromised PrestaShop Stores (DeadTag)
Coruna and DarkSword iOS Spyware Delivered via Instagram (TL-2026-4518), also tracked as DeadTag, is a high-severity malware campaign, first published 2026-10-27. It has no confirmed attribution, affects Apple iOS (Safari / WebKit), references 13 CVEs (CVE-2024-23222, CVE-2023-32434, CVE-2023-38606), maps to 13 MITRE ATT&CK techniques (T1005, T1027, T1055), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 13Referenced vulnerabilities
- Techniques
- 13MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-4518
- Threat ID
- TL-2026-4518
- Also known as
- DeadTag, DarkSword P7
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- cryptocurrency, ecommerce, general consumers, online media and advertising
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in Coruna and DarkSword iOS Spyware Delivered via Instagram
Malware and tooling: Coruna, DarkSword, GHOSTBLADE, PlasmaLoader
How Coruna and DarkSword iOS Spyware Delivered via Instagram works
Report URI and iVerify researchers describe 'DeadTag', an operation that delivers the Coruna and DarkSword (P7 variant) iOS exploit kits through World Cup-themed Instagram ads (ad-track.live), 660+ re-registered expired ad/analytics domains embedded in thousands of sites (~135 million monthly visits) and hundreds of compromised PrestaShop stores. Exploitation starts automatically in Safari when a qualifying iPhone loads the content, and the payloads steal keychain secrets and cryptocurrency wallet data.
DeadTag is a malvertising / supply-chain-style delivery operation reported on 2026-10-27 by GBHackers, based on research by Report URI (Scott Helme, who identified DeadTag) and iVerify. Operators buy expired domains that formerly served advertising or analytics tags. Thousands of websites still reference those tags, so the new owners inherit their traffic. Researchers count 660+ such domains, exposing an estimated 135 million visits per month. The operation selectively redirects qualifying iPhones to exploit kits. A parallel stream uses World Cup-themed Instagram ads pointing to ad-track.live, a fraudulent Polymarket page that delivers both exploit kits, and hundreds of compromised PrestaShop stores whose loaders are hidden in analytics-like directories. The attacks are described as 'half-click': the victim only has to encounter the page or ad, and exploitation can begin automatically when the content loads.
The payload kits are Coruna and DarkSword. Coruna (publicly disclosed 2026-03-03 by Google GTIG and iVerify) contains 23 exploits in five full chains covering iOS 13 through 17.2.1. Its primary chain abuses a WebKit JIT type confusion (CVE-2024-23222), followed by ASLR bypass, a sandbox escape, a PAC bypass and a 31,308-byte ARM64 shellcode stager, then a Mach-O implant ('PlasmaLoader') that runs inside legitimate processes (powerd, locationd, imagent, SpringBoard, WhatsApp). It targets crypto wallets (MetaMask, Phantom, Uniswap, Exodus, TronLink, Bitget Wallet and others), Photos and Notes, and SMS/iMessage. The kit aborts when Lockdown Mode, private browsing or Corellium virtualization is detected. It reached criminals after earlier use by a commercial surveillance vendor customer and by UNC6353, a suspected Russian espionage group (watering holes on Ukrainian sites, cdn.uacounter.com). UNC6691, a financially motivated China-based group, later deployed it on fake cryptocurrency and financial sites.
DarkSword (disclosed by Google in March 2026) chains six vulnerabilities (CVE-2025-31277, CVE-2025-43510, CVE-2025-43520, CVE-2025-43529, CVE-2025-14174, CVE-2026-20700) against iOS 18.4 to 18.7 and drops the GHOSTBLADE data miner. The DeadTag coverage describes a modified 'P7' variant aimed at newer iOS versions; placeholders for iOS 26 and 27 exist but are described as largely nonfunctional. After disclosure, actors added improved jailbreak and virtualization detection, better encryption, Telegram-focused implants and new persistence, and iVerify tracks about 17,000 domains hosting second-generation iterations. The DeadTag operator is unidentified. Chinese-language development comments, infrastructure linked to Chinese crypto/payment sites and the crypto-theft focus point to a financially motivated, Chinese-speaking operation, but the sources state this does not establish nationality or state sponsorship. The sources do not tie the specific CVEs to the DeadTag P7 variant, so the CVE list reflects the underlying Coruna and DarkSword kits.
MITRE ATT&CK techniques used in TL-2026-4518
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1055 Process Injection; T1497.001 System Checks
Command and Control
T1071.001 Web Protocols; T1568.002 Domain Generation Algorithms
Initial Access
T1190 Exploit Public-Facing Application; T1659 Content Injection
Execution
T1203 Exploitation for Client Execution
Credential Access
Resource Development
T1583.001 Domains; T1583.008 Malvertising; T1608.004 Drive-by Target
Affected products and versions in Coruna and DarkSword iOS Spyware Delivered via Instagram
- Apple — iOS (Safari / WebKit)
Vulnerable versions: iOS 13 through 17.2.1 (Coruna, full coverage); iOS 18.4 through 18.7.x before the DarkSword fixes (DarkSword)
Fixed in: iOS 17.4+ neutralizes the full Coruna kit; iOS 18.7.6 / 26.3.1 and later per Help Net Security - PrestaShop — PrestaShop e-commerce stores (compromised, used to host loaders)
Vulnerable versions: Compromised installations; initial compromise vector not stated in sources
Remediation for Coruna and DarkSword iOS Spyware Delivered via Instagram
Patches
- Apple iOS 17.4 or later (Coruna), iOS 18.7.6 or 26.3.1 or later (DarkSword per Help Net Security)
Immediate actions
- Update iPhones to the latest iOS release; iOS 17.4+ neutralizes the full Coruna kit and iOS 18.7.6 / 26.3.1 or later covers the DarkSword CVEs
- Enable Lockdown Mode on high-risk devices (Coruna aborts when it is detected)
- Block the listed domains and IPs at DNS and proxy, and alert on 15-character .xyz domains
- Rotate keychain-stored credentials and cryptocurrency wallet secrets on any device that may have loaded a malicious ad or page, and preserve forensic evidence
Workarounds
- Lockdown Mode
- Audit PrestaShop installations for loaders hidden in analytics-like directories and hidden zero-size iframes (group.html, analytics.html)
Longer-term hardening
- Remove obsolete third-party ad, analytics and tag integrations from websites and audit references to expired domains
- Monitor newly introduced scripts and domains and enforce a restrictive Content Security Policy
- Deploy client-side script monitoring, since origin server logs show nothing unusual
- Use mobile threat detection to look for thread names plasma_supervisor, plasma_unified_dispatcher and helion_ipc_handler
CVEs associated with Coruna and DarkSword iOS Spyware Delivered via Instagram
Timeline of Coruna and DarkSword iOS Spyware Delivered via Instagram
- Start of a roughly 10-week cluster of domain registrations (November 2025 to January 2026) supporting UNC6691's Coruna delivery on fake crypto and gambling sites, per cside.
- Initial DarkSword deployment detected (November 2025; day approximate), including Snapchat-themed sites targeting Saudi Arabian users (UNC6748).
- Additional DarkSword campaigns identified (January 2026; day approximate).
- Google GTIG and iVerify independently publish analysis of the Coruna kit (23 exploits, five chains, iOS 13 to 17.2.1) and its reuse by UNC6353 and UNC6691.
- Help Net Security reports Google's public disclosure of DarkSword: six chained vulnerabilities, GHOSTBLADE payload, UNC6748 and UNC6353 use.
- GBHackers reports DeadTag: Coruna and DarkSword P7 delivered via World Cup-themed Instagram ads (ad-track.live), 660+ hijacked expired domains (~135M monthly visits) and compromised PrestaShop stores; Report URI and iVerify credited.
Sources cited for Coruna and DarkSword iOS Spyware Delivered via Instagram
- Hackers Use Instagram Ads to Deploy Coruna and DarkSword Spyware on iPhones (GBHackers)
- Hackers Turn Malicious Ads Into iPhone Spyware Trap, Infecting Users Without a Click (IBTimes SG)
- Coruna: Inside the nation-state grade iOS exploit kit we've been tracking (iVerify)
- Inside Coruna: web script iOS exploit analysis (cside)
- DarkSword: Researchers uncover another iOS exploit kit (Help Net Security)
- Nation-State iOS Exploit Kit Coruna Found Powering Global Attacks (SecurityWeek)
Detection coverage for TL-2026-4518
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4518 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4518
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.