Criminal crews have started using ordinary web traffic as an infection route for iPhones, and neither of the two campaigns documented this week needs a victim to tap anything.
An ad, a scroll, and a compromised handset
Research published on October 22 by iVerify and Report URI traces delivery plumbing rather than a single exploit. Both groups concluded that Coruna and DarkSword, the spyware kits they track, now arrive through advertising. Paid placements carry one; script tags publishers quit maintaining years ago carry the other.
The clearest case involved an employee at a financial customer of iVerify. A World Cup themed placement served from ad-track[.]live appeared inside Instagram, ran code as they scrolled, checked the handset’s iOS build, then pushed a DarkSword variant the firm calls P7. Keychain secrets and wallet apps were the target. Weeks later the same person was hit again through a malicious link.
Report URI’s campaign, named DeadTag, works on neglected plumbing. Some 630 domains once used for analytics tags were re-registered after expiring while nearly 8,000 sites kept loading scripts from them. iPhones running an exploitable release get sorted out and handed to a buyer. The operation tallies 135 million monthly visits across sites still positioned to deliver the kits.
Why the wallet is the tell
Both kits strip location data, messages, contacts and credentials, but this build hunts crypto holdings, naming Trust Wallet, Coinbase Wallet, OKX, Bitget, Exodus, TronLink and Bitpie among targets.
Attribution stops short of certainty. DeadTag looks like a commercial broker selling qualified audiences upward. The exploit crew left Chinese-language notes in its loader and its servers sit beside Chinese gambling and payment sites, none of which proves nationality.
Apple patched the flaws both rely on. A current handset is not the qualifying visitor DeadTag is shopping for.
