DeadTag: How Forgotten Website Tags Became a Delivery Network for iPhone Spyware

Combined research between Report URI and iVerify has uncovered an extensive ecosystem being used to deliver two of the most capable iOS exploit kits ever seen, Coruna and DarkSword. Over the last month, our respective security teams have been tracking this proliferation, Report URI from the web delivery side and iVerify from the client-side.

Attackers are buying up the expired domains behind old analytics and advertising tags that thousands of websites still load, and they're selling the visitors those tags bring in. Most of that traffic goes to scams, but the tags also quietly pick out iPhone visitors and load these advanced exploit kits, which steal keychain passwords and target crypto wallets.

Finding the DeadTag operator

Earlier this month we wrote about an abandoned analytics domain that was sending online shoppers to iPhone exploits. We've continued to expand our research in this area, tying together multiple different exploit kits, domains, infrastructure and infected platforms. It turns out that this is no small operation and the domain was part of a much larger operation, an operation we're naming DeadTag.

DeadTag doesn't hack websites, because it doesn't need to. It takes over the bits of other companies' code that websites stopped paying attention to years ago, and uses them to deliver a variety of malicious content.

Tags that nobody remembers

Almost every website loads code from other companies: an analytics tool, an ad network, a support widget, an AI chat bot. Adding one is usually a single line in the page, known as a "tag", that tells the browser to fetch a script from the provider's domain.

These third-party services come and go quite easily, maybe the analytics start-up shuts down or the ad network folds, and the tag becomes redundant. When that happens, the line in the website's code usually stays where it is, because nothing visibly breaks. The browser asks for the script, it gets nothing back, and the page carries on as normal. Eventually the provider stops renewing its domain name, it expires, and the domain goes back on the market and is available to purchase again.

That's the gap that DeadTag exploits, the operator buys those expired domains as soon as they come up for sale. The moment they own one, every website still carrying the old tag starts loading the attackers' new code, on every page and for every visitor, without the site owner changing anything or noticing anything.

So far we've identified 660+ expired and re-registered domains being abused this way, and they are still embedded on literally thousands of websites that we've found and confirmed so far, with a cautiously estimated 135 million visits a month.

What the DeadTag code does

The script that these malicious domains serve is tiny, it's barely 2 KB, and for almost everyone it does nothing at all. The operator is very selective in who they target, and what they deliver to their chosen targets.

1. It checks who's visiting. Search engines, security scanners, automated browsers and anything else that looks like a bot gets nothing.
2. It asks the attackers' server what to do. The server decides, visitor by visitor, whether this one is worth launching the attack.
3. The chosen ones get redirected, presumably auction-style to the highest bidder, visitors can be sent on to anywhere DeadTag chooses.

To everyone else the site looks completely normal. When we investigated from data-centre IP addresses, or came back too often from residential IP addresses, the operators simply stopped answering. We had to use residential connections so that we look like ordinary home users, and do so on regular rotation before the chain would play out at all. This is why DeadTag has stayed hidden, to a security scanner, the "malicious" script is most often just an empty response.

DeadTag is selling traffic

To see who was buying, we followed the chain countless times, including as an iPhone visitor, starting from different dead tags. The visitors went all over the place:

• A fake "this video isn't available in your country, use a VPN" pop-up pushing a VPN install
• Fake surveys and "you've won" prize pages
• Search-advert pages for car deals and dentists
• A decoy redirect to Google
• Betting and crypto-casino scam sign-up pages
• An iPhone exploit kit

The same dead tag could send one visitor almost anywhere, presumably sold to the highest bidder, so it looks like DeadTag owns the visitors, and buyers bid for them.

The worst buyer: the iPhone Exploit Crew

Both iPhone exploit paths run through the same advertising gateway, which belongs to the exploit crew, and ended at a fake Polymarket prediction-market page. That one page serves two different iPhone attack kits, choosing between them by the iOS version of the device visiting:

• Coruna for older iPhones, iOS 13 to 17.2.1
• DarkSword for iOS 18.4 - 18.7, specifically a modified "P7" variant that iVerify have documented and we've branded P7 DarkSword (AKS40) based on the build tag used by the operator.

These are not phishing pages or fake app downloads, both kits attack the browser itself. Simply opening the page is enough for your device to be compromised. There's nothing to tap, you don't need to click any link, nothing to install and no warning. If the iPhone is running a vulnerable version of iOS, the kit breaks out of the browser and installs spyware on the device.

We decoded the full chain for both kits, including the spyware they install. It's built to steal:

• passwords and secrets from the iPhone's keychain
• crypto wallet apps, including Binance, Coinbase Wallet, OKX, Bitget, Trust Wallet, Exodus, TronLink and Bitpie
• device and account information, sent back to the attackers' server

A reboot of the phone may stop the active implant, but even if it does, by then, it's probably far too late.

The detail that ties it all together is the server the spyware reports to. Coruna and DarkSword are separate exploit kits that have been seen in different campaigns, but in this operation, both send their stolen data to the same server. We're looking at one operator running both DarkSword and Coruna, and choosing to deliver whichever kit fits the victim's phone best.

The crew doesn't rely solely on DeadTag

Buying traffic from DeadTag is only one of the ways that the iPhone Exploit Crew find victims, it's also hacking websites directly.

We found the crew's DarkSword loader planted on hundreds of online shops, all on the same e-commerce platform, PrestaShop, tucked into a folder named to look like analytics code. Each of those shops can quietly turn its iPhone customers into targets. While working through our data we also found a clothing retailer loading both Coruna and DarkSword at once, from servers we hadn't seen before, and when we traced every server hosting the crew's Coruna loader, we found hundreds more sites of its own.

Who is behind it?

Attribution is hard, and we have two different operators that we need to consider:

DeadTag: we don't know. Nothing in its code or infrastructure points to a particular country or group. It looks like a commercial traffic operation that will sell to anyone.

The iPhone exploit crew: everything we've seen points in the same direction, the crew looks to be at least Chinese-speaking.

• The code itself has notes in Chinese.
  • The DarkSword loader and worker we captured carry the developer's comments in simplified Chinese, explaining how they stop the attack running twice on the same phone.
  • Their copy of Coruna also contains leftover debugging code with Chinese notes, which indicates the operators had been modifying the Coruna payload themselves, not just running it as they found it.
• When we traced every server hosting the Coruna loader, we found hundreds of sites. Nearly all of them are Chinese-language crypto exchanges, USDT and Tron payment sites, gambling sites, and lookalikes of Chinese shopping and travel brands.
• The wallets the spyware targets lean heavily towards ones popular with Chinese-speaking crypto users, such as Bitpie, TronLink, OKX and Bitget.
• The exploit pages report back with "channel codes", the tracking method of an affiliate scheme where different groups bring in traffic and get credited for the victims.

None of that is proof of course, but it at least reads like a financially motivated, Chinese-speaking crypto-theft operation. I'd be comfortable to say that they're either Chinese, or they really want us to think that they're Chinese.

What you can do

If you run a website:

1. Audit your third-party tags. Go through every external script your site loads and remove any for services you no longer use. A tag still loading from a dead service is potentially a huge breach waiting to happen.
2. Know what your pages are loading. Script monitoring tells you when a new script or a new domain turns up on your site. Most site owners have no idea the dead tags are even there.
3. Use a Content Security Policy. Control what domains your site is allowed to load code from, and know when that code changes. This could indicate a DeadTag attack.

Report URI's Threat Intelligence feed already flags the DeadTag domains, the exploit hosts and the Coruna and DarkSword infrastructure we've found, so customers are alerted if any of them shows up on their site. If you'd like to see what your own site is loading, start a 30-day trial.

If you use an iPhone:

1. Keep iOS up to date. Both kits target older versions of iOS, so the newest version is your best protection.
2. Turn on Lockdown Mode if you might be a target, for example if you hold significant amounts of crypto. It helps to prevent exactly the kind of browser attack these kits rely on.
3. If you think you were hit, restart the phone, change the passwords stored in your keychain, and move your crypto to a new wallet with a new recovery phrase.

Closing thoughts

DeadTag is a good reminder that a website's attack surface isn't only its own code. Every tag you ever added is a promise that someone else's domain will stay in safe hands. When those companies disappear, or their code changes, the promise doesn't, and right now someone is buying up the broken ones and pointing them at iPhone users.

We'll keep tracking both DeadTag and the iPhone exploit crew and adding what we find to our Threat Intelligence feed. To know if you've been hit, you can deploy Report URI and audit the code currently running your site.

Start a 30-day free trial, no credit card required: Get Started Now →