Malicious Ads and Expired Web Tags Deliver Coruna and DarkSword iPhone Exploits

Joint research by iVerify and Report URI uncovered financially motivated campaigns distributing the Coruna and DarkSword iOS exploit kits through malicious advertisements, abandoned third-party website tags, and compromised websites. One documented incident involved an Instagram World Cup advertisement delivering DarkSword’s P7 variant to a vulnerable iPhone without an advertisement click or software installation. Exploitation occurs when malicious content loads and targets older, vulnerable iOS versions; the findings do not demonstrate compromise of fully updated iPhones. Payloads can steal keychain credentials, cryptocurrency wallet information, messages, contacts, and location data.

Report URI also identified DeadTag, a traffic-brokering operation that acquires expired advertising and analytics domains still embedded in thousands of websites, then redirects visitors toward scams or exploit infrastructure. Associated sites receive approximately 135 million monthly visits, a measure of potential exposure—not confirmed infections. Evidence suggests a Chinese-speaking cryptocurrency-theft crew operates the exploit infrastructure, but its identity, DeadTag’s operators, and any state involvement remain unestablished. Organizations should prioritize iOS updates, consider Lockdown Mode for higher-risk users, and reduce website exposure by removing abandoned tags, monitoring third-party scripts, and enforcing a Content Security Policy.