# Coruna and DarkSword iOS Spyware Delivered via Instagram Ads, Hijacked Expired Ad/Analytics Domains and Compromised PrestaShop Stores (DeadTag)

> Report URI and iVerify researchers describe 'DeadTag', an operation that delivers the Coruna and DarkSword (P7 variant) iOS exploit kits through World Cup-themed Instagram ads (ad-track.live), 660+ re-registered expired ad/analytics domains embedded in thousands of sites (~135 million monthly visits) and hundreds of compromised PrestaShop stores. Exploitation starts automatically in Safari when a qualifying iPhone loads the content, and the payloads steal keychain secrets and cryptocurrency wallet data.

- **Published:** 2026-10-27T06:28:44Z
- **Last reviewed:** 2026-10-27T06:28:44Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4518
- **ID:** TL-2026-4518
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-23222, CVE-2023-32434, CVE-2023-38606, CVE-2024-23225, CVE-2024-23296, CVE-2022-48503, CVE-2023-43000, CVE-2025-31277, CVE-2025-43510, CVE-2025-43520, CVE-2025-43529, CVE-2025-14174, CVE-2026-20700

## Description

DeadTag is a malvertising / supply-chain-style delivery operation reported on 2026-10-27 by GBHackers, based on research by Report URI (Scott Helme, who identified DeadTag) and iVerify. Operators buy expired domains that formerly served advertising or analytics tags. Thousands of websites still reference those tags, so the new owners inherit their traffic. Researchers count 660+ such domains, exposing an estimated 135 million visits per month. The operation selectively redirects qualifying iPhones to exploit kits. A parallel stream uses World Cup-themed Instagram ads pointing to ad-track.live, a fraudulent Polymarket page that delivers both exploit kits, and hundreds of compromised PrestaShop stores whose loaders are hidden in analytics-like directories. The attacks are described as 'half-click': the victim only has to encounter the page or ad, and exploitation can begin automatically when the content loads.

The payload kits are Coruna and DarkSword. Coruna (publicly disclosed 2026-03-03 by Google GTIG and iVerify) contains 23 exploits in five full chains covering iOS 13 through 17.2.1. Its primary chain abuses a WebKit JIT type confusion (CVE-2024-23222), followed by ASLR bypass, a sandbox escape, a PAC bypass and a 31,308-byte ARM64 shellcode stager, then a Mach-O implant ('PlasmaLoader') that runs inside legitimate processes (powerd, locationd, imagent, SpringBoard, WhatsApp). It targets crypto wallets (MetaMask, Phantom, Uniswap, Exodus, TronLink, Bitget Wallet and others), Photos and Notes, and SMS/iMessage. The kit aborts when Lockdown Mode, private browsing or Corellium virtualization is detected. It reached criminals after earlier use by a commercial surveillance vendor customer and by UNC6353, a suspected Russian espionage group (watering holes on Ukrainian sites, cdn.uacounter.com). UNC6691, a financially motivated China-based group, later deployed it on fake cryptocurrency and financial sites.

DarkSword (disclosed by Google in March 2026) chains six vulnerabilities (CVE-2025-31277, CVE-2025-43510, CVE-2025-43520, CVE-2025-43529, CVE-2025-14174, CVE-2026-20700) against iOS 18.4 to 18.7 and drops the GHOSTBLADE data miner. The DeadTag coverage describes a modified 'P7' variant aimed at newer iOS versions; placeholders for iOS 26 and 27 exist but are described as largely nonfunctional. After disclosure, actors added improved jailbreak and virtualization detection, better encryption, Telegram-focused implants and new persistence, and iVerify tracks about 17,000 domains hosting second-generation iterations. The DeadTag operator is unidentified. Chinese-language development comments, infrastructure linked to Chinese crypto/payment sites and the crypto-theft focus point to a financially motivated, Chinese-speaking operation, but the sources state this does not establish nationality or state sponsorship. The sources do not tie the specific CVEs to the DeadTag P7 variant, so the CVE list reflects the underlying Coruna and DarkSword kits.

## MITRE ATT&CK

- T1583.001 Domains
- T1583.008 Malvertising
- T1608.004 Drive-by Target
- T1190 Exploit Public-Facing Application
- T1659 Content Injection
- T1203 Exploitation for Client Execution
- T1497.001 System Checks
- T1027 Obfuscated Files or Information
- T1055 Process Injection
- T1555.001 Keychain
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1568.002 Domain Generation Algorithms

## Sources

- [Hackers Use Instagram Ads to Deploy Coruna and DarkSword Spyware on iPhones (GBHackers)](https://gbhackers.com/coruna-and-darksword-target-ios/)
- [Hackers Turn Malicious Ads Into iPhone Spyware Trap, Infecting Users Without a Click (IBTimes SG)](https://www.ibtimes.sg/A000OpA)
- [Coruna: Inside the nation-state grade iOS exploit kit we've been tracking (iVerify)](https://iverify.com/blog/coruna-inside-the-nation-state-grade-ios-exploit-kit-we-ve-been-tracking)
- [Inside Coruna: web script iOS exploit analysis (cside)](https://cside.com/blog/inside-coruna-web-script-ios-exploit)
- [DarkSword: Researchers uncover another iOS exploit kit (Help Net Security)](https://www.helpnetsecurity.com/2026/03/19/darksword-ios-exploit-iphone/)
- [Nation-State iOS Exploit Kit Coruna Found Powering Global Attacks (SecurityWeek)](https://www.securityweek.com/nation-state-ios-exploit-kit-coruna-found-powering-global-attacks/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4518