Cybercriminal groups are exploiting the online advertising ecosystem to silently deliver two of the most capable iPhone exploit kits ever observed to everyday users, according to a joint investigation published this week by iVerify and Report URI. The attacks require no tap, no app installation, and no interaction beyond visiting a compromised webpage or scrolling past an infected ad.
The research documents the first known cases of criminal-led mass spyware campaigns using the same malvertising techniques that nation-state actors have long used in targeted operations. The findings point to a significant escalation in the threat facing ordinary iPhone owners.
How the attacks work
iVerify and Report URI approached the problem from different directions. iVerify’s threat intelligence team tracked infections on customer devices, while Report URI investigated how the exploits were being delivered across the web. Their findings led them to what the researchers describe as the “obfuscated underbelly of the digital advertising world.”
Multiple criminal groups were found exploiting different parts of the advertising infrastructure to distribute the Coruna and DarkSword exploit kits through what iVerify calls “half-click” attacks.
In one case, iVerify detected the P7 variant of DarkSword being delivered through a malicious Instagram ad themed around the World Cup. The ad was served from a domain called ad-track[.]live and infected an employee’s device at a customer organization while the person was simply scrolling through their feed.
The same employee was later targeted again by an entirely different group using another DarkSword variant. Fortunately, the customer’s security team received near-real-time alerts and was able to rotate credentials before the stolen data could be used to access corporate networks.
How these malicious ads are getting through Meta’s vetting process remains unclear. The researchers believe the operators may be hiding within the complex network of ad sellers and resellers, taking advantage of a compromised vendor, or exploiting the sheer scale of Meta’s advertising platform to get malicious content through before it can be flagged.
Report URI’s investigation uncovered a broader campaign that researchers have named “DeadTag” which takes advantage of a common practice across the modern web. Most websites load third-party code for services such as analytics, advertising, customer support, and chatbots. These services typically rely on small snippets known as tags, which fetch scripts from external domains.
When the companies providing those services shut down or allow their domains to expire, the tags often remain embedded in website code for years.
DeadTag operators have been systematically purchasing these expired domains and using the traffic they continue to receive to redirect unsuspecting visitors. Much of that traffic ends up on conventional scam pages promoting fake VPN software, prizes, betting sites, and search ads.
The operation also identifies visitors using iPhones and silently directs qualifying devices to servers delivering Coruna and DarkSword.
Researchers have already identified hundreds of expired and re-registered domains being abused in this way. The domains remain embedded on thousands of websites, including sites belonging to well-known consumer brands.
Based on current findings, the operation receives an estimated 135 million visits per month to websites capable of serving spyware to visitors who meet certain conditions. Researchers expect that figure to grow as they uncover more of the infrastructure.
Researchers also found a higher concentration of European country-code domains compared with .com domains.
The DeadTag infrastructure contains placeholders for future exploit kits targeting iOS 26 and iOS 27, suggesting the operators are already preparing for newer versions of Apple’s operating system. iVerify says it has observed attempts to adapt Coruna and DarkSword for those releases, although the work so far has been largely unsuccessful. Researchers described the efforts as “mostly non-functioning AI slop.”
What the spyware steals
Once an iPhone is compromised, both exploit kits can extract substantial amounts of sensitive information.
The variants documented in the investigation were configured to steal passwords and other secrets stored in the iPhone’s keychain. They also targeted cryptocurrency wallet apps, including Binance, Coinbase Wallet, OKX, Bitget, Trust Wallet, Exodus, TronLink, and Bitpie, while collecting device and account information for transmission to attacker-controlled servers.
Researchers found that both exploit kits were sending stolen data to the same server despite being delivered through different mechanisms. This suggests a single operator may be responsible for the spyware deployments, while DeadTag appears to operate separately as a service that supplies or sells traffic.
The investigation also uncovered the DarkSword loader planted directly on hundreds of online stores running the PrestaShop e-commerce platform. The malicious code was hidden in folders with names designed to resemble legitimate analytics components.
At another clothing retailer, researchers found both Coruna and DarkSword loading simultaneously from previously unknown servers. Further investigation connected those servers to hundreds of additional websites.
A shift from targeted to mass exploitation
The findings come just a week after Citizen Lab published research into a campaign it called “AdFection” and documented how targeted advertisements were used to infect journalists with Candiru spyware. The attacks relied on device-specific identifiers obtained through a proprietary de-anonymization platform.
While Citizen Lab’s investigation showed how advertising data can be used to target specific individuals, the iVerify and Report URI findings reveal how similar infrastructure is now being exploited by less sophisticated criminal groups to reach much larger numbers of potential victims.
As Kaspersky noted in its own analysis, the spread of Coruna and DarkSword signals a fundamental change in the iPhone threat landscape.
Sophisticated iPhone exploits were once largely associated with nation-state intelligence agencies targeting politicians, activists, journalists, and diplomats. These kits have brought similar capabilities into the hands of financially motivated criminals who are willing to target ordinary users.
Dark Reading has reported that roughly 17,000 domains are now hosting variants of the two exploit chains.
Malvertising itself is not new. According to figures cited by iVerify, it accounted for an estimated 60 percent of malware and phishing delivery last year. What makes this campaign different is the use of advertising infrastructure to compromise iPhones at a scale not previously documented.
Attribution remains uncertain
The researchers distinguish between the DeadTag operation, which generates and redirects web traffic, and the group responsible for deploying the iPhone exploits.
In DeadTag’s case, the available code and infrastructure offer no clear indication of a particular country or organization. Researchers believe it operates as a commercial traffic service willing to sell access to whoever is prepared to pay.
The group deploying the exploits has left behind more clues, although none provide definitive attribution.
iVerify and Report URI found Chinese-language comments in the code and noted that some victims had connections to Mandarin or Cantonese speakers. Those findings are consistent with observations made by other research teams investigating earlier DarkSword campaigns.
For now, the researchers describe the operators as “at least Chinese-speaking,” while acknowledging that identifying the people or organizations behind the attacks remains difficult.
Leave a Reply