Dead Domains, Live Exploits: How Infected Ads and Expired Analytics Tags Deliver Coruna and DarkSword to iPhones

Executive Summary

Combined research between iVerify and Report URI uncovers multiple vectors within the advertising ecosystem several cybercriminal groups are using to automatically deliver two of the most capable iOS exploit kits we've seen, Coruna and DarkSword, as iPhone users browse the web and doomscroll. Malvertising isn’t new, it’s an elegant way to solve a threat actor’s reach problem of getting malware in front of vast audiences. Last year, malvertising accounted for 60% of malware and phishing and this blog details the first observed cases of those same tactics used for criminal-led, mass spyware attacks. 

The Investigations

Over the last month respective teams at iVerify and Report URI have been tracking the proliferation of DarkSword and Coruna, iVerify from the on-device side and Report URI via web delivery. Our independent investigations met in the obfuscated underbelly of the digital advertising world where we both observed cybercriminal groups leveraging different portions of ad-based infrastructure to deliver these exploit kits in what we’ve dubbed “half-click” attacks, that do require an iPhone user to visit an infected webpage or social media site then are automatically infected when advertising elements of the page load.

iVerify caught the P7 variant of DarkSword delivered through a malicious Instagram ad themed around the World Cup. The ad, served from ad-track[ . ]live, infected an employee mobile device at one of our customer organizations while they were simply scrolling their in-app feed. This same employee was attacked again after clicking on a malicious link served up by a completely separate group using a different DarkSword variant. Because the customer’s security team was alerted to these attacks in near real time, they were able to rotate credentials before stolen credentials could be sold and used to gain corporate network access.

Report URI uncovered a criminal campaign it’s dubbed DeadTag, that works by attackers buying up the expired domains behind old analytics and advertising tags that thousands of websites still load, and selling the visitors those tags bring in to other criminal groups. Most of the redirected traffic goes to scams, but the tags also quietly pick out iPhone visitors and deliver them Coruna and DarkSword, which steal keychain passwords and target crypto wallets among other capabilities. The operation is set up to leverage future iPhone exploit kits with placeholders to sort and deliver spyware targeting iOS 26 and 27. While the iVerify team has seen attempts to retool Coruna and DarkSword for these versions, it’s mostly non-functioning AI slop for now.

This operation is vast; while the investigation is still ongoing, the team has already identified hundreds of expired and re-registered domains being abused this way, that are still embedded on thousands of websites including of well-known brands that you’ve probably shopped with in your life if not regularly. Based on current findings, DeadTag appears to be mostly focused on European domains versus .com which is unusual given the popularity of .com sites. Even so, the operation within current purview sees 135 million visits a month to sites that can serve Coruna or DarkSword spyware if the visitor fits the qualifying conditions. That number is expected to grow as more DeadTag-affiliated sites are uncovered.

This timely investigation builds on the Citizen Lab report published last week detailing what it's calling an “AdFection” campaign, wherein targeted ads purchased by Israeli adtech company Discover-Tech were used to infect Al Jazeera journalists with Candiru spyware based on device-specific indicators it was able to pull with a proprietary de-anonymization platform. Where Citizen Lab’s investigation details how adtech and device data can be leveraged for highly targeted attacks, iVerify and Report URI’s data shows similar techniques being used by non-sophisticated actors in mass attacks with the only requirement that the victim is running a vulnerable version of iOS.

How Advertising Infrastructure Is Used

There is an extensive shadow network of adtech platforms serving spyware to iPhones. 

• Ad targeting: In the case of the Citizen Lab investigation, Discover-Tech was masquerading as a legitimate company purchasing ads above board picked to go after hand-selected targets. With DarkSword and Coruna, threat actors are able to serve compromised ads to populations that are most likely to hold crypto leading to a higher percentage of successful attacks. This is very likely why we saw one crypto-holding iPhone user swept up in two completely different attacks - one via malicious Instagram ad and the other via malicious link.

• Third-party integrations: Almost every website loads code from other companies - an analytics tool, an ad network, a support widget, an AI chat bot. Adding one is usually a single line in the page, known as a "tag", that tells the browser to fetch a script from the provider's domain. In the DeadTag campaign, the operator takes over the bits of other companies' code that websites stopped paying attention to years ago, and uses them to deliver a variety of malicious content.

• Masquerading as tools: The iPhone exploit crew buying traffic from DeadTag was also observed directly compromising websites with both spyware kits. The operator’s DarkSword loader was found planted on hundreds of online shops, all on the same e-commerce platform, PrestaShop, tucked into a folder named to look like analytics code, quietly turning iPhone customers into targets. Another clothing retailer loaded both Coruna and DarkSword at once, from previously unseen servers that were then traced to hundreds more sites of its own.

On Instagram, it’s less clear how malicious ads are getting through Meta’s vetting process, perhaps they have completely obfuscated their presence in the highly complex networks of sellers and resellers or they have compromised one of the vendors in the system giving them the ability to push their own code. It could be as simple as taking advantage of the scale of Meta’s operation, slipping malicious content through that is then later flagged and removed.

In all cases, the infection is automatic as the malicious asset is loaded on the page i.e. the victim visits a website owned or co-opted by DeadTag or scrolls by an ad on Instagram, no click required. Our suspicion is that any ad-supported platform may carry similar risk.

The Motive

Like most cybercriminal groups we see, the motive looks to be financial gain. Both iOS exploit kits have implants to probe and drain crypto wallets and many previously observed campaigns targeted crypto and gambling sites most likely to draw people in who own crypto. But directly hitting the targets’ wallet is only one monetization path, Coruna and DarkSword both have the ability to pull vast amounts of data from iPhones including location data, passwords, messages and contacts, which can be packaged and sold on criminal forums like we see with data from corporate and government cyber breaches should the iPhone exploit crew choose. 

DeadTag is making money by funneling qualified leads (i.e. those who fit a certain profile whether that’s running a specific version of iOS or some other indicator) to other criminal groups, presumably auction style to the highest bidder. When the team at Report URI followed the various trails victims were being redirected to, they ended up varied places including:

• A fake "this video isn't available in your country, use a VPN" pop-up pushing a VPN install

• Fake surveys and "you've won" prize pages

• Search-advert pages for car deals and dentists

• A decoy redirect to Google

• Betting and crypto-casino scam sign-up pages

• A fake Polymarket page that served both Coruna and P7 DarkSword by attacking the browser itself requiring just a site visit to infect a vulnerable device

We know it’s the same operator serving the two different exploit kits because the data they grab are sent back to the same server. The particular variants served were built to steal:

• Passwords and secrets from the iPhone's keychain

• Crypto wallet apps, including Binance, Coinbase Wallet, OKX, Bitget, Trust Wallet, Exodus, TronLink and Bitpie

• Device and account information, sent back to the attackers' server

Who’s Behind DeadTag and Who’s the Exploit Crew They’re Working With?

Attribution is hard, and here it's two questions, not one. With DeadTag we don't know. Nothing in its code or infrastructure points to a particular country or group. It looks like a commercial traffic operation that will sell to anyone and we’ve seen operations like these located in and spread across many geographies. For the iPhone exploit crew, everything we've seen points in the same direction and aligns with what other research teams have seen with previous DarkSword deployments; suggesting the crew is at least Chinese-speaking if not actually Chinese or at minimum, want us to think they are. 

iVerify saw commonalities among the victims it saw including some connection to China such as being a Mandarin or Cantonese speaker and during its code tear down, Report URI saw code notes in Chinese both in the DarkSword loader and worker explaining how they stop the attack running twice on the same phone as well as in the debugging code in their variant of Coruna, indicating the operators had been modifying the Coruna payload themselves, not just running it as they found it.

When traced, every server hosting the Coruna loader also contained hundreds of Chinese-language crypto exchanges, USDT and Tron payment sites, gambling sites, and lookalikes of Chinese shopping and travel brands. The wallets the spyware targets lean heavily towards ones popular with Chinese-speaking crypto users, such as Bitpie, TronLink, OKX and Bitget. 

None of that is a smoking gun, but it reads like a financially motivated, Chinese-speaking crypto-theft operation.

What You Can Do

If you run a website:

1. Audit your third-party tags. Go through every external script your site loads and remove any for services you no longer use. A tag still loading from a dead service is potentially a huge breach waiting to happen.

2. Know what your pages are loading. Script monitoring tells you when a new script or a new domain turns up on your site. Most site owners have no idea the dead tags are even there.

3. Use a Content Security Policy. Control what domains your site is allowed to load code from, and know when that code changes. This could indicate a DeadTag attack.

Report URI's Threat Intelligence feed already flags the DeadTag domains, the exploit hosts and the uncovered Coruna and DarkSword infrastructure so customers are alerted if any of them shows up on their site. Click here if you'd like to see what your own site is loading.

If you’re an iPhone user:

1. Keep iOS up to date and apply patches as soon as they are released. Both kits target older versions of iOS, so the newest version is your best protection if you don’t have a mobile EDR provided by your company.

2. Turn on Lockdown Mode if you might be a target, for example if you hold significant amounts of crypto. It helps to prevent exactly the kind of browser attack these kits rely on but it does significantly change your user experience.

3. If you think you were hit, first run a scan with iVerify Basic, iVerify’s free app to preserve your log data and scan for indicators of compromise, then restart the phone, change the passwords stored in your keychain, and move your crypto to a new wallet with a new recovery phrase.

For businesses with iPhones in your enterprise, reach out to hear more about how iVerify can protect your mobile fleet from sophisticated spyware including Candiru, Coruna and DarkSword as well as other mobile-based threats.

Conclusion

Coruna and DarkSword show how far exploit kits that once belonged to a handful of well-resourced actors have spread. Tools of this caliber used to be reserved for narrow, targeted operations as demonstrated in the Citizen Lab research, but attackers can now buy and rent their way into similar capabilities. Delivering them through the advertising ecosystem removes the last real constraint: reach. 

Expired tag domains hand attackers a steady stream of visitors from thousands of sites that never knew the infrastructure had changed hands, and infected ads on social platforms can compromise a vulnerable iPhone the moment they load, with no click and no mistake by the victim. The ad ecosystem already does what attackers need: it profiles devices, routes traffic, and delivers content at scale, all while looking like legitimate commerce. As long as the web is held together by abandoned third-party tags and ad pipelines that nobody audits, the cost of reaching a victim keeps falling, and so does the effort needed to turn a sophisticated exploit into a commodity. Defenders need to view iPhones the same way as the do traditional computers, as vulnerable endpoints that require constant on-device monitoring or cybercriminals and sophisticated attackers will find their way in through stale tags and ad-delivered content.