Hijacked website tags and Instagram ads deliver Coruna and DarkSword spyware to outdated iPhones ยท updates https://pwn.watch/i/deadtag-coruna-darksword-iphone-exploits Report URI and iVerify found criminals using 660+ re-registered expired analytics and ad-tag domains (DeadTag), hacked PrestaShop stores and a malicious Instagram ad to silently serve the Coruna (iOS 13 to 17.2.1) and P7 DarkSword (iOS 18.4 to 18.7) exploit kits. Opening an affected page on a vulnerable iPhone is enough; the spyware steals keychain passwords, crypto wallet data and device info. Updated iPhones are protected, so update iOS (or turn on Lockdown Mode if you can't). en Thu, 22 Oct 2026 00:00:00 GMT Hijacked website tags and Instagram ads deliver Coruna and DarkSword spyware to outdated iPhones: Report URI detailed the DeadTag operation: 660+ re-registered expired tag domains still loaded on thousands of sites (an estimated 135 million visits a month), selling visitor traffic to buyers including a Chinese-speaking crew that serves Coruna and DarkSword from a fake Polymarket page. The crew's DarkSword loader was also found on hundreds of hacked PrestaShop stores. https://pwn.watch/i/deadtag-coruna-darksword-iphone-exploits https://pwn.watch/i/deadtag-coruna-darksword-iphone-exploits#2026-10-22-c25cef58 Thu, 22 Oct 2026 00:00:00 GMT high <p><a href="https://blog.report-uri.com/deadtag-how-forgotten-website-tags-became-a-delivery-network-for-iphone-spyware/">Source</a></p> Hijacked website tags and Instagram ads deliver Coruna and DarkSword spyware to outdated iPhones: iVerify and Report URI published joint research: a World Cup themed Instagram ad served from ad-track[.]live infected a financial-institution employee's iPhone with P7 DarkSword while they scrolled their feed, and expired analytics and ad-tag domains were redirecting iPhone visitors to Coruna and DarkSword. https://pwn.watch/i/deadtag-coruna-darksword-iphone-exploits https://pwn.watch/i/deadtag-coruna-darksword-iphone-exploits#2026-10-21-ccafe327 Wed, 21 Oct 2026 00:00:00 GMT high <p><a href="https://www.iverify.com/blog/blog-malvertising-coruna-darksword-iphone-exploits">Source</a></p>