# DeadTag campaign: Coruna and DarkSword iPhone exploit kits delivered via expired ad/analytics tags, compromised websites and malicious ads

> DeadTag is a traffic-delivery operation that re-registers expired analytics/advertising domains still referenced by thousands of websites and uses the resulting tags to deliver the Coruna (iOS 13.0-17.2.1) and DarkSword (iOS 18.4-18.7) exploit kits to selected iPhone visitors. The kits steal keychain secrets and cryptocurrency wallet data; both report to the same server, indicating a single, apparently Chinese-speaking, financially motivated operator.

- **Published:** 2026-10-27T20:32:46Z
- **Last reviewed:** 2026-10-27T20:32:46Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4566
- **ID:** TL-2026-4566
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-23222, CVE-2021-30952, CVE-2022-48503, CVE-2023-43000, CVE-2023-32409, CVE-2020-27932, CVE-2020-27950, CVE-2023-32434, CVE-2023-41974, CVE-2023-38606, CVE-2024-23225, CVE-2024-23296, CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520

## Description

Report URI and iVerify jointly disclosed DeadTag on 2026-10-21. Attackers bought expired domain names behind old analytics and advertising tags that website owners never removed. Those tags load attacker-controlled code, which fingerprints visitors, filters out bots, search engines and security scanners, and hands selected visitors to exploit code or sells the traffic on in an auction-style redirection to other criminal groups. Report URI reports 6,600 real websites carrying the linked code, 248 of which served iPhone spyware directly (about 49 million combined monthly visits, about 8 million to the 248 sites per BeEncrypted's summary); Report URI and iVerify elsewhere estimate 135 million monthly visits to sites able to serve the spyware and 660+ re-registered domains. Additional delivery paths include hundreds of compromised PrestaShop e-commerce stores, a clothing retailer loading both kits at once, hundreds of Chinese-language crypto exchange, USDT/Tron payment and gambling lookalike sites hosting Coruna loaders, a fake Polymarket prediction-market page, and a malicious Instagram ad (domain ad-track.live) delivering the DarkSword P7 variant.

Coruna, documented by Google Threat Intelligence Group in March 2026, is a kit of 5 full iOS exploit chains and 23 exploits for iOS 13.0-17.2.1. Its flow is device fingerprinting, WebKit remote code execution (e.g. CVE-2024-23222), PAC bypass, sandbox escape, privilege escalation, PPL bypass and kernel exploitation, ending in the PlasmaLoader (PLASMAGRID) implant installed as bundle com.apple.assistd. PlasmaLoader steals data from crypto wallet apps (18 targeted), decodes QR codes from stored images, searches Apple Memos for BIP39 seed phrases and keywords such as 'backup phrase', downloads further modules, and talks to DGA-generated .xyz C2 domains (seed 'lazarus') over HTTPS with AES. Coruna bails out when Lockdown Mode is enabled. Resources are referenced by sha256(COOKIE+ID)[:40], payload blobs use header 0xf00dbeef with ChaCha20 and LZW, and loader JavaScript uses XOR string obfuscation. Simplified Chinese strings appear in implant logging.

DarkSword targets iOS 18.4-18.7 with a one-click chain beginning in JavaScript in a WebKit content process and ending with native libraries injected into processes such as SpringBoard, using six CVEs (CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520; three were zero-days). It was publicly revealed on 2026-03-18 by GTIG, iVerify and Lookout and had earlier been used by UNC6353 (suspected Russian espionage), UNC6748 and the commercial surveillance vendor PARS Defense. In DeadTag a modified P7 variant tagged AKS40 by iVerify is used. DarkSword and Coruna send stolen data to the same server, so one operator chooses whichever kit fits the victim's iOS version. Stolen data includes keychain passwords and secrets, device and account information, location, messages and contacts, and crypto wallet data (Binance, Coinbase Wallet, OKX, Bitget, Trust Wallet, Exodus, TronLink, Bitpie).

Attribution: the DeadTag traffic operator is unknown. The party running the exploit kits is assessed as a Chinese-speaking, financially motivated crypto-theft crew based on simplified-Chinese developer comments and targeting; GTIG tracks the broad Coruna fake-finance-site campaigns as UNC6691. No NSA link to Coruna has been shown. Note: no domains, IPs or hashes were published for the DeadTag-specific infrastructure itself; IOCs below are drawn from the Coruna/DarkSword reporting and the one ad-delivery domain named by iVerify. The databreaches.net and Forbes pages returned HTTP 403 and were not read directly. A BeaconBeagle domain query for ad-track.live returned no matches.

## MITRE ATT&CK

- T1583.001 Domains
- T1608.004 Drive-by Target
- T1658 Exploitation for Client Execution
- T1404 Exploitation for Privilege Escalation
- T1480 Execution Guardrails
- T1027 Obfuscated Files or Information
- T1634.001 Keychain
- T1409 Stored Application Data
- T1437.001 Web Protocols
- T1637.001 Domain Generation Algorithms
- T1521 Encrypted Channel
- T1646 Exfiltration Over C2 Channel

## Sources

- [DeadTag: How Forgotten Website Tags Became a Delivery Network for iPhone Spyware (Report URI)](https://blog.report-uri.com/deadtag-how-forgotten-website-tags-became-a-delivery-network-for-iphone-spyware/)
- [Dead Domains, Live Exploits: How Infected Ads and Expired Analytics Tags Deliver Coruna and DarkSword to iPhones (iVerify)](https://www.iverify.com/blog/blog-malvertising-coruna-darksword-iphone-exploits)
- [Thousands of Websites Used to Deliver Coruna and DarkSword iPhone Spyware (BeEncrypted)](https://beencrypted.com/privacy/news/deadtag-campaign-iphone-spyware)
- [Hackers Are Serving Malware To iPhones Via Hundreds Of Infected Websites (Forbes)](https://www.forbes.com/sites/thomasbrewster/2026/10/22/apple-iphone-hacks-via-infected-websites/)
- [Hackers Are Serving Malware To iPhones Via Hundreds Of Infected Websites (DataBreaches.net)](https://databreaches.net/2026/10/27/hackers-are-serving-malware-to-iphones-via-hundreds-of-infected-websites/)
- [Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit (Google Threat Intelligence Group)](https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit)
- [Coruna iOS Exploit Kit Uses 23 Exploits Across Five Chains (The Hacker News)](https://thehackernews.com/2026/03/coruna-ios-exploit-kit-uses-23-exploits.html)
- [DarkSword iOS Exploit Kit Uses 6 Flaws (The Hacker News)](https://thehackernews.com/2026/03/darksword-ios-exploit-kit-uses-6-flaws.html)
- [DarkSword Exploit Kit (Lookout)](https://security.lookout.com/threat-intelligence/article/darksword-exploit-kit)
- [CISA orders feds to patch DarkSword iOS flaws exploited in attacks (BleepingComputer)](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-darksword-ios-flaws-exploited-attacks/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4566