Coruna and DarkSword iOS exploit kits delivered via Instagram ads, DeadTag hijacked ad domains and compromised PrestaShop stores
Criminal operators are distributing the Coruna and DarkSword iOS exploit kits through malicious Instagram ads, hijacked abandoned analytics and advertising domains, and compromised websites. Researchers call these "half-click" attacks: exploitation can begin automatically when malicious content loads. iVerify observed the P7 variant of DarkSword reaching an employee's iPhone through a World Cup-themed Instagram ad served from ad-track[.]live. Report URI identified a parallel operation, dubbed DeadTag, that buys expired domains once tied to ad and analytics services. Infrastructure and code comments point to a Chinese-speaking, financially motivated operation, but operators remain unidentified and no nationality or state sponsorship is established.
Detalhes técnicos
- DeadTag acquires expired ad and analytics domains that thousands of sites still reference through forgotten third-party script tags. It redirects visitors to scams and routes qualifying iPhones to Coruna and DarkSword delivery infrastructure.
- Hundreds of abused domains are embedded across thousands of sites, including recognizable brands. Sites in scope receive about 135 million monthly visits. That figure measures potential exposure, not confirmed infections.
- Hundreds of PrestaShop stores were compromised, with DarkSword loaders hidden in directories resembling analytics components. One retailer loaded both kits.
- A fraudulent Polymarket page delivered Coruna and P7 DarkSword, with stolen data sent to the same server, linking both payloads to one operator.
- Variants targeted keychain passwords, account data and crypto apps: Binance, Coinbase Wallet, OKX, Bitget, Trust Wallet, Exodus, TronLink and Bitpie.
- The operation contains placeholders for routing iOS 26 and 27 devices, but observed attempts to adapt the kits to those versions were largely nonfunctional.
- The same employee later met a separate group distributing another DarkSword variant through a malicious link. Near-real-time alerts let the security team rotate credentials before the stolen data could be resold or used.
- It is not established how the ad passed Meta's screening. Compromised intermediaries, obfuscated delivery chains and screening failures are possible but unconfirmed.
- The findings parallel Citizen Lab's AdFection research, which linked Discover-Tech ads to Candiru infections at Al Jazeera (targeted surveillance).
Remediação
- Website administrators should remove obsolete third-party integrations, monitor newly introduced scripts and domains, and enforce a restrictive Content Security Policy.
- iPhone users should install current security updates, and higher-risk users should consider Lockdown Mode.
- Organizations investigating suspected compromise should preserve forensic evidence and rotate exposed credentials.
Linha do tempo
-
Coruna and DarkSword iOS exploit kits delivered via Instagram ads, DeadTag hijacked ad domains and compromised PrestaShop stores
ler a análise desta fonte ocultar
Criminal operators are distributing the Coruna and DarkSword iOS exploit kits through malicious Instagram ads, hijacked abandoned analytics and advertising domains, and compromised websites. Researchers call these "half-click" attacks: exploitation can begin automatically when malicious content loads. iVerify observed the P7 variant of DarkSword reaching an employee's iPhone through a World Cup-themed Instagram ad served from ad-track[.]live. Report URI identified a parallel operation, dubbed DeadTag, that buys expired domains once tied to ad and analytics services. Infrastructure and code comments point to a Chinese-speaking, financially motivated operation, but operators remain unidentified and no nationality or state sponsorship is established.
Technical Details
- DeadTag acquires expired ad and analytics domains that thousands of sites still reference through forgotten third-party script tags. It redirects visitors to scams and routes qualifying iPhones to Coruna and DarkSword delivery infrastructure.
- Hundreds of abused domains are embedded across thousands of sites, including recognizable brands. Sites in scope receive about 135 million monthly visits. That figure measures potential exposure, not confirmed infections.
- Hundreds of PrestaShop stores were compromised, with DarkSword loaders hidden in directories resembling analytics components. One retailer loaded both kits.
- A fraudulent Polymarket page delivered Coruna and P7 DarkSword, with stolen data sent to the same server, linking both payloads to one operator.
- Variants targeted keychain passwords, account data and crypto apps: Binance, Coinbase Wallet, OKX, Bitget, Trust Wallet, Exodus, TronLink and Bitpie.
- The operation contains placeholders for routing iOS 26 and 27 devices, but observed attempts to adapt the kits to those versions were largely nonfunctional.
- The same employee later met a separate group distributing another DarkSword variant through a malicious link. Near-real-time alerts let the security team rotate credentials before the stolen data could be resold or used.
- It is not established how the ad passed Meta's screening. Compromised intermediaries, obfuscated delivery chains and screening failures are possible but unconfirmed.
- The findings parallel Citizen Lab's AdFection research, which linked Discover-Tech ads to Candiru infections at Al Jazeera (targeted surveillance).
Remediation
- Website administrators should remove obsolete third-party integrations, monitor newly introduced scripts and domains, and enforce a restrictive Content Security Policy.
- iPhone users should install current security updates, and higher-risk users should consider Lockdown Mode.
- Organizations investigating suspected compromise should preserve forensic evidence and rotate exposed credentials.