Hijacked website tags and Instagram ads deliver Coruna and DarkSword spyware to outdated iPhones
Apple iOS (Safari/WebKit) on out-of-date iPhones
Report URI and iVerify found criminals using 660+ re-registered expired analytics and ad-tag domains (DeadTag), hacked PrestaShop stores and a malicious Instagram ad to silently serve the Coruna (iOS 13 to 17.2.1) and P7 DarkSword (iOS 18.4 to 18.7) exploit kits. Opening an affected page on a vulnerable iPhone is enough; the spyware steals keychain passwords, crypto wallet data and device info. Updated iPhones are protected, so update iOS (or turn on Lockdown Mode if you can't).
Why this severity: Exploited in the wild via drive-by web and ad attacks; only out-of-date iOS versions are affected
- Started
- Oct 21, 2026
Affected
- iOS 13 to 17.2.1 (Coruna)
- iOS 18.4 to 18.7 (P7 DarkSword)
Fixed in
- Latest iOS 26
- Latest updates for iOS 15 through iOS 18 (Apple says updated devices are protected)
Timeline2
Report URI detailed the DeadTag operation: 660+ re-registered expired tag domains still loaded on thousands of sites (an estimated 135 million visits a month), selling visitor traffic to buyers including a Chinese-speaking crew that serves Coruna and DarkSword from a fake Polymarket page. The crew's DarkSword loader was also found on hundreds of hacked PrestaShop stores.
iVerify and Report URI published joint research: a World Cup themed Instagram ad served from ad-track[.]live infected a financial-institution employee's iPhone with P7 DarkSword while they scrolled their feed, and expired analytics and ad-tag domains were redirecting iPhone visitors to Coruna and DarkSword.
Advisories1
News & write-ups5
- DeadTag: How Forgotten Website Tags Became a Delivery Network for iPhone SpywareReport URI · Oct 22, 2026 · Write-up
- Dead Domains, Live Exploits: How Infected Ads and Expired Analytics Tags Deliver Coruna and DarkSword to iPhonesiVerify · Oct 21, 2026 · Write-up
- Sleep, Beacon, Steal, Repeat - The Story of P7 DarkSword VariantiVerify · Oct 8, 2026 · Write-up
- Hackers are turning web browsing into an iPhone trapAxios · Oct 22, 2026
- Hackers Are Serving Malware to iPhones via Infected WebsitesForbes · Oct 22, 2026
Posts1
Forgotten website tags are being turned into spyware delivery routes. Working with iVerify, we traced DeadTag: 660+ hijacked domains, thousands of sites, and traffic feeding the Coruna and DarkSword iPhone exploit kits. The investigation: t.co/iwh7rNhDBv t.co/XI6iBreI3T
Notes & caveats
No new CVEs: both kits use already-patched iOS bugs against devices that haven't updated. Apple's support note says devices on the latest iOS 15 through iOS 26 releases, or with Lockdown Mode on, are protected, and Safari Safe Browsing blocks the known malicious domains. Site owners should remove third-party tags for services they no longer use and use a Content Security Policy.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
