# Hijacked website tags and Instagram ads deliver Coruna and DarkSword spyware to outdated iPhones · pwn.watch > Report URI and iVerify found criminals using 660+ re-registered expired analytics and ad-tag domains (DeadTag), hacked PrestaShop stores and a malicious Instagram ad to silently serve the Coruna (iOS 13 to 17.2.1) and P7 DarkSword (iOS 18.4 to 18.7) exploit kits. Opening an affected page on a vulnerable iPhone is enough; the spyware steals keychain passwords, crypto wallet data and device info. Updated iPhones are protected, so update iOS (or turn on Lockdown Mode if you can't). Page: https://pwn.watch/i/deadtag-coruna-darksword-iphone-exploits · generated 2026-10-23T11:47:48.642Z ## Status - Severity: high · status: live · patch: patched - Product: Apple iOS (Safari/WebKit) on out-of-date iPhones - Started: 2026-10-21 - Affected: iOS 13 to 17.2.1 (Coruna); iOS 18.4 to 18.7 (P7 DarkSword) - Fixed in: Latest iOS 26; Latest updates for iOS 15 through iOS 18 (Apple says updated devices are protected) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/deadtag-coruna-darksword-iphone-exploits/feed.xml - JSON Feed: https://pwn.watch/i/deadtag-coruna-darksword-iphone-exploits/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/deadtag-coruna-darksword-iphone-exploits.json - This file: https://pwn.watch/i/deadtag-coruna-darksword-iphone-exploits/llms.txt ## Updates (newest first) - 2026-10-22: Report URI detailed the DeadTag operation: 660+ re-registered expired tag domains still loaded on thousands of sites (an estimated 135 million visits a month), selling visitor traffic to buyers including a Chinese-speaking crew that serves Coruna and DarkSword from a fake Polymarket page. The crew's DarkSword loader was also found on hundreds of hacked PrestaShop stores. (https://blog.report-uri.com/deadtag-how-forgotten-website-tags-became-a-delivery-network-for-iphone-spyware/) - 2026-10-21: iVerify and Report URI published joint research: a World Cup themed Instagram ad served from ad-track[.]live infected a financial-institution employee's iPhone with P7 DarkSword while they scrolled their feed, and expired analytics and ad-tag domains were redirecting iPhone visitors to Coruna and DarkSword. (https://www.iverify.com/blog/blog-malvertising-coruna-darksword-iphone-exploits) ## Fix brief # Security brief: Hijacked website tags and Instagram ads deliver Coruna and DarkSword spyware to outdated iPhones Source: https://pwn.watch/i/deadtag-coruna-darksword-iphone-exploits · status: live · severity: high · updated Oct 23, 2026, 11:25 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is Report URI and iVerify found criminals using 660+ re-registered expired analytics and ad-tag domains (DeadTag), hacked PrestaShop stores and a malicious Instagram ad to silently serve the Coruna (iOS 13 to 17.2.1) and P7 DarkSword (iOS 18.4 to 18.7) exploit kits. Opening an affected page on a vulnerable iPhone is enough; the spyware steals keychain passwords, crypto wallet data and device info. Updated iPhones are protected, so update iOS (or turn on Lockdown Mode if you can't). Severity detail: Exploited in the wild via drive-by web and ad attacks; only out-of-date iOS versions are affected - Product: Apple iOS (Safari/WebKit) on out-of-date iPhones ## Affected versions - iOS 13 to 17.2.1 (Coruna) - iOS 18.4 to 18.7 (P7 DarkSword) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Latest iOS 26 - Latest updates for iOS 15 through iOS 18 (Apple says updated devices are protected) After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Latest updates - Oct 22, 2026: Report URI detailed the DeadTag operation: 660+ re-registered expired tag domains still loaded on thousands of sites (an estimated 135 million visits a month), selling visitor traffic to buyers including a Chinese-speaking crew that serves Coruna and DarkSword from a fake Polymarket page. The crew's DarkSword loader was also found on hundreds of hacked PrestaShop stores. - Oct 21, 2026: iVerify and Report URI published joint research: a World Cup themed Instagram ad served from ad-track[.]live infected a financial-institution employee's iPhone with P7 DarkSword while they scrolled their feed, and expired analytics and ad-tag domains were redirecting iPhone visitors to Coruna and DarkSword. ## Advisories - [Update iOS to protect your iPhone from web attacks](https://support.apple.com/en-us/126776) (Apple) ## Write-ups & news - [DeadTag: How Forgotten Website Tags Became a Delivery Network for iPhone Spyware](https://blog.report-uri.com/deadtag-how-forgotten-website-tags-became-a-delivery-network-for-iphone-spyware/) - [Dead Domains, Live Exploits: How Infected Ads and Expired Analytics Tags Deliver Coruna and DarkSword to iPhones](https://www.iverify.com/blog/blog-malvertising-coruna-darksword-iphone-exploits) - [Sleep, Beacon, Steal, Repeat - The Story of P7 DarkSword Variant](https://www.iverify.com/blog/darksword-variant-threat-research) - [Hackers are turning web browsing into an iPhone trap](https://www.axios.com/2026/10/22/spyware-phones-security-threats) - [Hackers Are Serving Malware to iPhones via Infected Websites](https://www.forbes.com/sites/thomasbrewster/2026/10/22/apple-iphone-hacks-via-infected-websites/) ## Caveats No new CVEs: both kits use already-patched iOS bugs against devices that haven't updated. Apple's support note says devices on the latest iOS 15 through iOS 26 releases, or with Lockdown Mode on, are protected, and Safari Safe Browsing blocks the known malicious domains. Site owners should remove third-party tags for services they no longer use and use a Content Security Policy. --- Machine-readable: https://pwn.watch/i/deadtag-coruna-darksword-iphone-exploits.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.