DeadTag Buys Expired Analytics Domains Still Loaded by Thousands of Sites and Sells the Traffic — iPhones Get Routed to Coruna and DarkSword Spyware

High · 2026-11-06 · By H.A

Researchers say the DeadTag operation re-registered hundreds of expired ad and analytics tag domains, which reach about 135 million visits a month, and routes iPhone visitors to the Coruna and DarkSword exploit kits; DarkSword loaders were also found on hundreds of PrestaShop stores and in an Instagram ad.

Overview

Security researchers have exposed DeadTag, a traffic-brokering operation that turns forgotten website code into a delivery route for iPhone spyware. The operators buy expired domains that once hosted analytics and advertising scripts. Thousands of websites still load tags from those domains, so whoever owns the domain decides what code runs in every visitor's browser.

Most of this hijacked traffic is sold on to scam operators. iPhone visitors, though, can be singled out and sent to one of two known iOS exploit kits: Coruna for older devices and the DarkSword "P7" variant for newer ones. Researchers say the attacks are "half-click". The exploit chain can start when an ad element or tag loads, without the victim tapping anything.

The Campaign

The researchers describe DeadTag as a marketplace more than a single attacker:

• Domain resurrection: analytics, tag-manager and ad-tech domains that were allowed to expire are re-registered. Researchers counted hundreds of these domains, and figures across reports range from about 600 to more than 660.
• Inherited reach: the websites embedding these tags reportedly receive around 135 million visits a month. Most of them are European rather than .com domains.
• Traffic auction: visitors are filtered and, according to the researchers, resold to other criminal groups in something like an auction. Search-engine crawlers, scanners and bots get clean responses.
• iPhone routing: qualifying iPhones are sent to Coruna if they run older iOS releases (reports cite iOS 13 to 17.2.1) or to DarkSword P7 if they run iOS 18.4 to 18.7.
• Future-proofing: the infrastructure contains placeholders for iOS 26 and 27 exploits. Researchers saw retooling attempts that are "mostly non-functioning" so far.

DeadTag also has two other delivery routes. A DarkSword loader was found on hundreds of PrestaShop online stores, hidden in a folder named to look like analytics code. One clothing retailer loaded both Coruna and DarkSword from servers that had not been seen before, and those servers led researchers to hundreds more sites. In a separate case, a World Cup-themed Instagram ad delivered the DarkSword P7 variant to a researcher's colleague while they scrolled the in-app feed.

Timeline

• September–October 2026: researchers track the web-delivery and on-device sides of the activity for about a month.
• 8 October 2026: researchers publish their analysis of the DarkSword P7 variant.
• Late October 2026: the joint DeadTag findings are published, about a week after separate academic research on ad-delivered iPhone exploits.
• Early November 2026: the findings are updated. A separate threat-intelligence bulletin connects DeadTag to the operators who use compromised PrestaShop stores.

Tradecraft

• Supply-chain by neglect: the operators compromise no websites. They take advantage of tags that site owners forgot to remove.
• Cloaking: filtering by user agent and visitor checks hide the payload from security tooling, so takedown teams and crawlers see benign pages.
• Device fingerprinting: the exploit kit is chosen to match the iOS version, so modern devices are not exposed to old, noisy exploits.
• Payload goals: both kits aim to steal keychain secrets, credentials and cryptocurrency wallet data. The wallets named include Binance, Coinbase Wallet and OKX.

Indicators of Compromise

• ad-track[.]live (host behind the malicious Instagram ad)
• PrestaShop module or asset folders named to resemble analytics components that load scripts from unfamiliar domains

The researchers have shared the full DeadTag domain list through a commercial threat feed. It has not been published openly.

Detection

• Website owners: list every third-party <script> source your pages load and resolve who owns each domain today. A tag pointing at a domain whose registration changed recently is a red flag.
• Enable Content Security Policy reporting (report-to/report-uri) so the browser tells you when your pages try to load scripts from unexpected domains.
• PrestaShop operators should check the modules/ and theme directories for analytics-named folders that were added without a change ticket.
• Mobile fleets: check for devices still on iOS 17.2.1 or earlier, or on iOS 18.4–18.7, and look in proxy or DNS logs for connections to newly registered ad or analytics domains.

# List external script hosts referenced by a page (defensive audit)
curl -s https://your-site.example/ | grep -oE '<script[^>]+src="https?://[^/"]+' | sort -u

Recommended Actions

1. Remove tags for analytics, A/B testing and ad services you no longer use. Do the same for old CMS plugins that embed them.
2. Enforce a restrictive Content Security Policy with an explicit script-src allow-list.
3. Update all iPhones to the latest supported iOS release, and retire devices that cannot be updated.
4. Turn on Lockdown Mode for high-risk users such as executives, journalists and crypto treasury staff.
5. If you suspect a compromise, reboot the device, update iOS, change passwords stored in the keychain, and move crypto funds to a new wallet with a new recovery phrase.

Analyst Assessment

DeadTag shows how much reach expired domains can carry. No zero-day is needed: the operators buy domains that thousands of trusted websites still call, then sell that traffic to whoever pays most, including exploit-kit operators. The exploits target older iOS builds, so up-to-date iPhones are largely protected. The bigger exposure is on the web side. Every site that still loads an abandoned tag is unknowingly helping deliver the exploits. We assess with moderate confidence that similar resold-traffic schemes will keep appearing as long as stale third-party tags go unaudited. Site owners should treat tag hygiene as a security control, not housekeeping.