DeadTag: re-registered domains of defunct analytics and advertising tags redirect visitors of thousands of sites, among them to a page that serves the Coruna and DarkSword iPhone exploit kits, which compromise a vulnerable device when the page opens

Report URI and iVerify describe a campaign they name DeadTag: attackers buy the expired domains behind old analytics and advertising tags that thousands of websites still load, so every page that still carries the tag runs the operator's script without the site owner changing or noticing anything, and the operator sells the visitors those tags bring in (Report URI, 2026-10-22). Report URI has identified more than 660 re-registered domains still embedded on thousands of sites and cautiously estimates 135 million visits a month (Report URI, 2026-10-22). The script is about 2 KB, does nothing for search engines, scanners and other bots, asks the operator's server what to do with each visitor and redirects the chosen ones, and Report URI found that the operator stopped answering when it probed from data-centre addresses or returned too often from residential ones; destinations include scam pages, a fake VPN pop-up and, for iPhones, a page that serves two exploit kits (Report URI, 2026-10-22).

One chain ends at a fake prediction-market page that picks the kit by the visitor's iOS version, Coruna for iOS 13 to 17.2.1 and a modified "P7" variant of DarkSword for iOS 18.4 to 18.7; both attack the browser itself, so opening the page is enough to compromise a vulnerable device, and the spyware they install steals keychain passwords, crypto-wallet app data and device and account information and reports to one server; Report URI notes that Coruna and DarkSword are separate exploit kits that have been seen in different campaigns, and that here both send their stolen data to the same server, which it reads as one operator running both (Report URI, 2026-10-22). iVerify reads DeadTag as mostly focused on European domains rather than .com (iVerify, 2026-10-21), and saw the P7 variant reach an employee's device at a customer organisation through a malicious Instagram ad while the employee was scrolling in the app (iVerify, 2026-10-21). The kit operator does not rely on DeadTag alone: Report URI found DarkSword loaders on hundreds of online shops on one e-commerce platform, PrestaShop (Report URI, 2026-10-22).