How Forgotten Website Tags Became a Delivery Network for iPhone Spyware

Combined research between Report URI and iVerify has uncovered an extensive ecosystem being used to deliver two of the most capable iOS exploit kits ever seen, Coruna and DarkSword. Over the last month, our respective security teams have been tracking this proliferation, Report URI from the web delivery side and iVerify from the client-side.

Attackers are buying up the expired domains behind old analytics and advertising tags that thousands of websites still load, and they're selling the visitors those tags bring in. Most of that traffic goes to scams, but the tags also quietly pick out iPhone visitors and load these advanced exploit kits, which steal keychain passwords and target crypto wallets.

Earlier this month we wrote about an abandoned analytics domain that was sending online shoppers to iPhone exploits. We've continued to expand our research in this area, tying together multiple different exploit kits, domains, infrastructure and infected platforms. It turns out that this is no small operation and the domain was part of a much larger operation, an operation we're naming DeadTag.

DeadTag doesn't hack websites, because it doesn't need to. It takes over the bits of other companies' code that websites stopped paying attention to years ago, and uses them to deliver a variety of malicious content.

Almost every website loads code from other companies: an analytics tool, an ad network, a support widget, an AI chat bot. Adding one is usually a single line in the page, known as a "tag", that tells the browser to fetch a script from the provider's domain.

These third-party services come and go quite easily, maybe the analytics start-up shuts down or the ad network folds, and the tag becomes redundant. When that happens, the line in the website's code usually stays where it is, because nothing visibly breaks. The browser asks for the script, it gets nothing back, and the page carries on as normal. Eventually the provider stops renewing its domain name, it expires, and the domain goes back on the market and is available to purchase again.

That's the gap that DeadTag exploits, the operator buys those expired domains as soon as they come up for sale. The moment they own one, every website still carrying the old tag starts loading the attackers' new code, on every page and for every visitor, without the site owner changing anything or noticing anything.

So far we've identified 660+ expired and re-registered domains being abused this way, and they are still embedded on literally thousands of websites that we've found and confirmed so far, with a cautiously estimated 135 million visits a month.

The script that these malicious domains serve is tiny, it's barely 2 KB, and for almost everyone it does nothing at all. The operator is very selective in who they target, and what they deliver to their chosen targets.

To everyone else the site looks completely normal. When we investigated from data-centre IP addresses, or came back too often from residential IP addresses, the operators simply stopped answering. We had to use residential connections so that we look like ordinary home users, and do so on regular rotation before the chain would play out at all. This is why DeadTag has stayed hidden, to a security scanner, the "malicious" script is most often just an empty response.

To see who was buying, we followed the chain countless times, including as an iPhone visitor, starting from different dead tags. The visitors went all over the place:

The same dead tag could send one visitor almost anywhere, presumably sold to the highest bidder, so it looks like DeadTag owns the visitors, and buyers bid for them.

Both iPhone exploit paths run through the same advertising gateway, which belongs to the exploit crew, and ended at a fake Polymarket prediction-market page. That one page serves two different iPhone attack kits, choosing between them by the iOS version of the device visiting:

These are not phishing pages or fake app downloads, both kits attack the browser itself. Simply opening the page is enough for your device to be compromised. There's nothing to tap, you don't need to click any link, nothing to install and no warning. If the iPhone is running a vulnerable version of iOS, the kit breaks out of the browser and installs spyware on the device.

We decoded the full chain for both kits, including the spyware they install. It's built to steal:

A reboot of the phone may stop the active implant, but even if it does, by then, it's probably far too late.

The detail that ties it all together is the server the spyware reports to. Coruna and DarkSword are separate exploit kits that have been seen in different campaigns, but in this operation, both send their stolen data to the same server. We're looking at one operator running both DarkSword and Coruna, and choosing to deliver whichever kit fits the victim's phone best.

Buying traffic from DeadTag is only one of the ways that the iPhone Exploit Crew find victims, it's also hacking websites directly.

We found the crew's DarkSword loader planted on hundreds of online shops, all on the same e-commerce platform, PrestaShop, tucked into a folder named to look like analytics code. Each of those shops can quietly turn its iPhone customers into targets. While working through our data we also found a clothing retailer loading both Coruna and DarkSword at once, from servers we hadn't seen before, and when we traced every server hosting the crew's Coruna loader, we found hundreds more sites of its own.

Attribution is hard, and we have two different operators that we need to consider:

DeadTag: we don't know. Nothing in its code or infrastructure points to a particular country or group. It looks like a commercial traffic operation that will sell to anyone.

The iPhone exploit crew: everything we've seen points in the same direction, the crew looks to be at least Chinese-speaking.

None of that is proof of course, but it at least reads like a financially motivated, Chinese-speaking crypto-theft operation. I'd be comfortable to say that they're either Chinese, or they really want us to think that they're Chinese.

Report URI's Threat Intelligence feed already flags the DeadTag domains, the exploit hosts and the Coruna and DarkSword infrastructure we've found, so customers are alerted if any of them shows up on their site. If you'd like to see what your own site is loading, start a 30-day trial.

DeadTag is a good reminder that a website's attack surface isn't only its own code. Every tag you ever added is a promise that someone else's domain will stay in safe hands. When those companies disappear, or their code changes, the promise doesn't, and right now someone is buying up the broken ones and pointing them at iPhone users.

We'll keep tracking both DeadTag and the iPhone exploit crew and adding what we find to our Threat Intelligence feed. To know if you've been hit, you can deploy Report URI and audit the code currently running your site.

Start a 30-day free trial, no credit card required: Get Started Now →