{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Hijacked website tags and Instagram ads deliver Coruna and DarkSword spyware to outdated iPhones · updates",
  "home_page_url": "https://pwn.watch/i/deadtag-coruna-darksword-iphone-exploits",
  "feed_url": "https://pwn.watch/i/deadtag-coruna-darksword-iphone-exploits/feed.json",
  "description": "Report URI and iVerify found criminals using 660+ re-registered expired analytics and ad-tag domains (DeadTag), hacked PrestaShop stores and a malicious Instagram ad to silently serve the Coruna (iOS 13 to 17.2.1) and P7 DarkSword (iOS 18.4 to 18.7) exploit kits. Opening an affected page on a vulnerable iPhone is enough; the spyware steals keychain passwords, crypto wallet data and device info. Updated iPhones are protected, so update iOS (or turn on Lockdown Mode if you can't).",
  "language": "en",
  "_pwn": {
    "slug": "deadtag-coruna-darksword-iphone-exploits",
    "severity": "high",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/deadtag-coruna-darksword-iphone-exploits/feed.xml",
    "llms": "https://pwn.watch/i/deadtag-coruna-darksword-iphone-exploits/llms.txt",
    "json": "https://pwn.watch/i/deadtag-coruna-darksword-iphone-exploits.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/deadtag-coruna-darksword-iphone-exploits#2026-10-22-c25cef58",
      "url": "https://pwn.watch/i/deadtag-coruna-darksword-iphone-exploits#2026-10-22-c25cef58",
      "title": "Hijacked website tags and Instagram ads deliver Coruna and DarkSword spyware to outdated iPhones: Report URI detailed the DeadTag operation: 660+ re-registered expired tag domains still loaded on thousands of sites (an estimated 135 million visits a month), selling visitor traffic to buyers including a Chinese-speaking crew that serves Coruna and DarkSword from a fake Polymarket page. The crew's DarkSword loader was also found on hundreds of hacked PrestaShop stores.",
      "content_text": "Hijacked website tags and Instagram ads deliver Coruna and DarkSword spyware to outdated iPhones: Report URI detailed the DeadTag operation: 660+ re-registered expired tag domains still loaded on thousands of sites (an estimated 135 million visits a month), selling visitor traffic to buyers including a Chinese-speaking crew that serves Coruna and DarkSword from a fake Polymarket page. The crew's DarkSword loader was also found on hundreds of hacked PrestaShop stores.\n\nSource: https://blog.report-uri.com/deadtag-how-forgotten-website-tags-became-a-delivery-network-for-iphone-spyware/",
      "date_published": "2026-10-22T00:00:00.000Z",
      "external_url": "https://blog.report-uri.com/deadtag-how-forgotten-website-tags-became-a-delivery-network-for-iphone-spyware/",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/deadtag-coruna-darksword-iphone-exploits#2026-10-21-ccafe327",
      "url": "https://pwn.watch/i/deadtag-coruna-darksword-iphone-exploits#2026-10-21-ccafe327",
      "title": "Hijacked website tags and Instagram ads deliver Coruna and DarkSword spyware to outdated iPhones: iVerify and Report URI published joint research: a World Cup themed Instagram ad served from ad-track[.]live infected a financial-institution employee's iPhone with P7 DarkSword while they scrolled their feed, and expired analytics and ad-tag domains were redirecting iPhone visitors to Coruna and DarkSword.",
      "content_text": "Hijacked website tags and Instagram ads deliver Coruna and DarkSword spyware to outdated iPhones: iVerify and Report URI published joint research: a World Cup themed Instagram ad served from ad-track[.]live infected a financial-institution employee's iPhone with P7 DarkSword while they scrolled their feed, and expired analytics and ad-tag domains were redirecting iPhone visitors to Coruna and DarkSword.\n\nSource: https://www.iverify.com/blog/blog-malvertising-coruna-darksword-iphone-exploits",
      "date_published": "2026-10-21T00:00:00.000Z",
      "external_url": "https://www.iverify.com/blog/blog-malvertising-coruna-darksword-iphone-exploits",
      "tags": [
        "high"
      ]
    }
  ]
}