Threat reportMalwareTL-2026-4566
DeadTag campaign: Coruna and DarkSword iPhone exploit kits delivered via expired ad/analytics tags, compromised websites and malicious ads
DeadTag campaign (TL-2026-4566), also tracked as DeadTag, is a high-severity malware campaign, first published 2026-10-27. It has no confirmed attribution, affects Apple iOS (iPhone), references 18 CVEs (CVE-2024-23222, CVE-2021-30952, CVE-2022-48503), maps to 12 MITRE ATT&CK techniques (T1027, T1404, T1409), and is covered by 9 detection rules and 19 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 18Referenced vulnerabilities
- Techniques
- 12MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 19Indicators of compromise
Key facts for TL-2026-4566
- Threat ID
- TL-2026-4566
- Also known as
- DeadTag, Coruna, PlasmaLoader, PLASMAGRID, DarkSword, P7 DarkSword (AKS40)
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, cryptocurrency, retail, consumer
- Target regions
- Global, China-speaking users
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in DeadTag campaign
Malware and tooling: Coruna, DarkSword, GHOSTBLADE, PlasmaLoader
How DeadTag campaign works
DeadTag is a traffic-delivery operation that re-registers expired analytics/advertising domains still referenced by thousands of websites and uses the resulting tags to deliver the Coruna (iOS 13.0-17.2.1) and DarkSword (iOS 18.4-18.7) exploit kits to selected iPhone visitors. The kits steal keychain secrets and cryptocurrency wallet data; both report to the same server, indicating a single, apparently Chinese-speaking, financially motivated operator.
Report URI and iVerify jointly disclosed DeadTag on 2026-10-21. Attackers bought expired domain names behind old analytics and advertising tags that website owners never removed. Those tags load attacker-controlled code, which fingerprints visitors, filters out bots, search engines and security scanners, and hands selected visitors to exploit code or sells the traffic on in an auction-style redirection to other criminal groups. Report URI reports 6,600 real websites carrying the linked code, 248 of which served iPhone spyware directly (about 49 million combined monthly visits, about 8 million to the 248 sites per BeEncrypted's summary); Report URI and iVerify elsewhere estimate 135 million monthly visits to sites able to serve the spyware and 660+ re-registered domains. Additional delivery paths include hundreds of compromised PrestaShop e-commerce stores, a clothing retailer loading both kits at once, hundreds of Chinese-language crypto exchange, USDT/Tron payment and gambling lookalike sites hosting Coruna loaders, a fake Polymarket prediction-market page, and a malicious Instagram ad (domain ad-track.live) delivering the DarkSword P7 variant.
Coruna, documented by Google Threat Intelligence Group in March 2026, is a kit of 5 full iOS exploit chains and 23 exploits for iOS 13.0-17.2.1. Its flow is device fingerprinting, WebKit remote code execution (e.g. CVE-2024-23222), PAC bypass, sandbox escape, privilege escalation, PPL bypass and kernel exploitation, ending in the PlasmaLoader (PLASMAGRID) implant installed as bundle com.apple.assistd. PlasmaLoader steals data from crypto wallet apps (18 targeted), decodes QR codes from stored images, searches Apple Memos for BIP39 seed phrases and keywords such as 'backup phrase', downloads further modules, and talks to DGA-generated .xyz C2 domains (seed 'lazarus') over HTTPS with AES. Coruna bails out when Lockdown Mode is enabled. Resources are referenced by sha256(COOKIE+ID)[:40], payload blobs use header 0xf00dbeef with ChaCha20 and LZW, and loader JavaScript uses XOR string obfuscation. Simplified Chinese strings appear in implant logging.
DarkSword targets iOS 18.4-18.7 with a one-click chain beginning in JavaScript in a WebKit content process and ending with native libraries injected into processes such as SpringBoard, using six CVEs (CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520; three were zero-days). It was publicly revealed on 2026-03-18 by GTIG, iVerify and Lookout and had earlier been used by UNC6353 (suspected Russian espionage), UNC6748 and the commercial surveillance vendor PARS Defense. In DeadTag a modified P7 variant tagged AKS40 by iVerify is used. DarkSword and Coruna send stolen data to the same server, so one operator chooses whichever kit fits the victim's iOS version. Stolen data includes keychain passwords and secrets, device and account information, location, messages and contacts, and crypto wallet data (Binance, Coinbase Wallet, OKX, Bitget, Trust Wallet, Exodus, TronLink, Bitpie).
Attribution: the DeadTag traffic operator is unknown. The party running the exploit kits is assessed as a Chinese-speaking, financially motivated crypto-theft crew based on simplified-Chinese developer comments and targeting; GTIG tracks the broad Coruna fake-finance-site campaigns as UNC6691. No NSA link to Coruna has been shown. Note: no domains, IPs or hashes were published for the DeadTag-specific infrastructure itself; IOCs below are drawn from the Coruna/DarkSword reporting and the one ad-delivery domain named by iVerify. The databreaches.net and Forbes pages returned HTTP 403 and were not read directly. A BeaconBeagle domain query for ad-track.live returned no matches.
MITRE ATT&CK techniques used in TL-2026-4566
Defense Evasion
T1027 Obfuscated Files or Information; T1480 Execution Guardrails
privilege-escalation
T1404 Exploitation for Privilege Escalation
Collection
command-and-control
T1437.001 Web Protocols; T1521 Encrypted Channel; T1637.001 Domain Generation Algorithms
Resource Development
T1583.001 Domains; T1608.004 Drive-by Target
credential-access
Exfiltration
T1646 Exfiltration Over C2 Channel
Execution
Affected products and versions in DeadTag campaign
- Apple — iOS (iPhone)
Vulnerable versions: 13.0 - 17.2.1 (Coruna); 18.4 - 18.7 (DarkSword)
Fixed in: 17.3 and later (Coruna WebKit entry); 18.7.6; 26.3.1 - Third-party website operators — Websites loading abandoned analytics/advertising tags; PrestaShop stores
Vulnerable versions: Sites referencing expired tag domains; Compromised PrestaShop installations
Fixed in: Remove stale tags; clean and update compromised shops
Remediation for DeadTag campaign
Patches
- Apple iOS 17.3 or later for Coruna's WebKit entry point (CVE-2024-23222)
- Apple iOS 18.7.6 / iOS 26.3.1 for all DarkSword vulnerabilities
- Separate security updates for older devices are listed on Apple's security support pages
Immediate actions
- Update iPhones to the latest iOS (Settings > General > Software Update); DarkSword fixes are in iOS 18.7.6 and 26.3.1, and Coruna does not work on iOS 17.3+ patched builds
- Enable Lockdown Mode on high-risk devices; Coruna exits when it is enabled
- Block the listed domains at DNS/proxy and hunt for requests to the Coruna delivery URL patterns and DGA .xyz domains
- Move cryptocurrency seed phrases out of Apple Notes/Memos, screenshots and photos, and rotate any exposed wallet secrets and passwords stored in iCloud Keychain
Workarounds
- Enable Lockdown Mode
- Use private browsing mode (reported as effective against Coruna by GTIG)
- Avoid cryptocurrency sites and apps from unverified links or ads on unpatched devices
Longer-term hardening
- Inventory third-party analytics/advertising tags and remove tags whose domains have lapsed or no longer belong to an active vendor
- Enforce Content-Security-Policy and Subresource Integrity on third-party scripts and use CSP reporting (e.g. Report URI) to spot unexpected script origins
- Use mobile threat defense/MDM to enforce minimum iOS versions and monitor for exploitation indicators
CVEs associated with DeadTag campaign
Timeline of DeadTag campaign
- Google Threat Intelligence Group first captures parts of the Coruna iOS exploit chain, used by a customer of a commercial surveillance vendor (February 2025).
- Coruna used by UNC6353 (suspected Russian espionage) in Ukrainian watering hole attacks via cdn.uacounter.com (summer 2025; exact day not stated).
- DarkSword in use by UNC6748 (Saudi Arabia, snapshare.chat) and PARS Defense (Turkey) from November 2025 (exact day not stated).
- UNC6353 begins using DarkSword against Ukrainian targets (December 2025); UNC6691 deploys Coruna in broad campaigns on fake financial/crypto sites by end of 2025.
- GTIG publishes Coruna research: 5 chains, 23 exploits, iOS 13.0-17.2.1, PlasmaLoader implant.
- GTIG, iVerify and Lookout simultaneously publish DarkSword research (6 CVEs, iOS 18.4-18.7).
- Report URI and iVerify jointly disclose DeadTag: expired ad/analytics tag domains delivering Coruna and DarkSword; 6,600 sites carry the code, 248 serve spyware directly.
- Forbes (Thomas Brewster) reports iPhone malware served via infected websites.
- DataBreaches.net republishes coverage of the campaign.
Sources cited for DeadTag campaign
- DeadTag: How Forgotten Website Tags Became a Delivery Network for iPhone Spyware (Report URI)
- Dead Domains, Live Exploits: How Infected Ads and Expired Analytics Tags Deliver Coruna and DarkSword to iPhones (iVerify)
- Thousands of Websites Used to Deliver Coruna and DarkSword iPhone Spyware (BeEncrypted)
- Hackers Are Serving Malware To iPhones Via Hundreds Of Infected Websites (Forbes)
- Hackers Are Serving Malware To iPhones Via Hundreds Of Infected Websites (DataBreaches.net)
- Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit (Google Threat Intelligence Group)
- Coruna iOS Exploit Kit Uses 23 Exploits Across Five Chains (The Hacker News)
- DarkSword iOS Exploit Kit Uses 6 Flaws (The Hacker News)
- DarkSword Exploit Kit (Lookout)
- CISA orders feds to patch DarkSword iOS flaws exploited in attacks (BleepingComputer)
Detection coverage for TL-2026-4566
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4566 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.