CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

DeadTag

campaign · campaign:deadtag

Operation named by Report URI and iVerify (2026-10-21 and 2026-10-22) that buys the expired domains of defunct analytics and advertising tags still loaded by thousands of websites and sells the visitors on, among others to an iPhone exploit crew whose page serves the Coruna and DarkSword kits; its operator is unknown.

Coverage
1
first 2026-10-28 → last 2026-10-28
Latest activity
2026-10-28
DeadTag: expired tag domains send visitors to iPhone exploit kits; opening the page is enough on vulnerable…
Peak priority
notable
1 notable
Targets
·
regions: europe
Sources cited
2
2 hosts

Action items (1)

Do-now tasks recorded on the entries about DeadTag, newest first. Check the date before acting on an older one.

Defender insights

What each entry about DeadTag tells a defender to do, newest first.

2026-10-28NOTABLEDeadTag: expired tag domains send visitors to iPhone exploit kits; opening the page is enough on vulnerable iOS

Exposure · detection

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

related to

Story timeline

  1. 2026-10-28DeadTag: re-registered domains of defunct analytics and advertising tags redirect visitors of thousands of sites, among them to a page that serves the Coruna and DarkSword iPhone exploit kits, which compromise a vulnerable device when the page opens
    active-threatsDeadTag: expired tag domains send visitors to iPhone exploit kits; opening the page is enough on vulnerable iOS

Hunting pivots

Affected products
Apple iOS
Tags
cryptocrimemobilesupply-chain
ATT&CK techniques (4 across 4 tactics)

4 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Resource DevelopmentCompromise Infrastructure: Domains
  • Initial AccessDrive-by Compromise
  • ExecutionExploitation for Client Execution
  • Credential AccessCredentials from Password Stores: Keychain

Resource Development TA0042

T1584.001Compromise Infrastructure: Domains×1

Adversaries may hijack domains and/or subdomains that can be used during targeting. Domain registration hijacking is the act of changing the registration of a domain name without the permission of the original registrant. Adversaries may gain access to an email account for the person listed as the owner of the domain. The adversary can then claim that they forgot their password in order to make changes to the domain registration. Other possibilities include social engineering a domain registration help desk to gain access to an account, taking advantage of renewal process gaps, or compromising a cloud service that enables managing domains (e.g., AWS Route53).

Evidence: 2026-10-28/deadtag-expired-tag-domains-coruna-darksword-iphone-kits · ATT&CK page ↗

Initial Access TA0001

T1189Drive-by Compromise×1

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including:

Evidence: 2026-10-28/deadtag-expired-tag-domains-coruna-darksword-iphone-kits · ATT&CK page ↗

Execution TA0002

T1203Exploitation for Client Execution×1

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.

Evidence: 2026-10-28/deadtag-expired-tag-domains-coruna-darksword-iphone-kits · ATT&CK page ↗

Credential Access TA0006

T1555.001Credentials from Password Stores: Keychain×1

Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. The default Keychain is the Login Keychain, which stores user passwords and information. The System Keychain stores items accessed by the operating system, such as items shared among users on a host. The Local Items (iCloud) Keychain is used for items synced with Apple’s iCloud service.

Evidence: 2026-10-28/deadtag-expired-tag-domains-coruna-darksword-iphone-kits · ATT&CK page ↗

Entries about DeadTag (1)

2026-10-28 · view entry permalink →

NOTABLENATOB2

DeadTag: re-registered domains of defunct analytics and advertising tags redirect visitors of thousands of sites, among them to a page that serves the Coruna and DarkSword iPhone exploit kits, which compromise a vulnerable device when the page opens

Report URI and iVerify describe a campaign they name DeadTag: attackers buy the expired domains behind old analytics and advertising tags that thousands of websites still load, so every page that still carries the tag runs the operator's script without the site owner changing or noticing anything, and the operator sells the visitors those tags bring in (Report URI, 2026-10-22). Report URI has identified more than 660 re-registered domains still embedded on thousands of sites and cautiously estimates 135 million visits a month (Report URI, 2026-10-22). The script is about 2 KB, does nothing for search engines, scanners and other bots, asks the operator's server what to do with each visitor and redirects the chosen ones, and Report URI found that the operator stopped answering when it probed from data-centre addresses or returned too often from residential ones; destinations include scam pages, a fake VPN pop-up and, for iPhones, a page that serves two exploit kits (Report URI, 2026-10-22).

One chain ends at a fake prediction-market page that picks the kit by the visitor's iOS version, Coruna for iOS 13 to 17.2.1 and a modified "P7" variant of DarkSword for iOS 18.4 to 18.7; both attack the browser itself, so opening the page is enough to compromise a vulnerable device, and the spyware they install steals keychain passwords, crypto-wallet app data and device and account information and reports to one server; Report URI notes that Coruna and DarkSword are separate exploit kits that have been seen in different campaigns, and that here both send their stolen data to the same server, which it reads as one operator running both (Report URI, 2026-10-22). iVerify reads DeadTag as mostly focused on European domains rather than .com (iVerify, 2026-10-21), and saw the P7 variant reach an employee's device at a customer organisation through a malicious Instagram ad while the employee was scrolling in the app (iVerify, 2026-10-21). The kit operator does not rely on DeadTag alone: Report URI found DarkSword loaders on hundreds of online shops on one e-commerce platform, PrestaShop (Report URI, 2026-10-22).

Attackers are buying up the expired domains behind old analytics and advertising tags that thousands of websites still load, and they're selling the visitors those tags bring in.

Simply opening the page is enough for your device to be compromised.

Audit your third-party tags.

Report URI (Scott Helme) 2026-10-22

Based on current findings, DeadTag appears to be mostly focused on European domains versus .com

iVerify caught the P7 variant of DarkSword delivered through a malicious Instagram ad themed around the World Cup.

iVerify Threat Intelligence Team 2026-10-21

Builds on: Microsoft: Star Blizzard adds mass mailings and a one-click scheduled-task chain to its… · Anthropic discloses a Russia-linked actor whose AI agents detect their own malware getting…

threat28 Oct 03:54Zmulti-sourceOpen finding →
Sources: Report URI (Scott Helme) · iVerify Threat Intelligence Team

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • blog.report-uri.com1 (50%)
  • iverify.com1 (50%)
All cited sources (2)