The researchers identified multiple delivery routes for Coruna and DarkSword, two exploit kits capable of compromising devices and extracting sensitive information. Their findings, published on 21 and 22 October, show how criminal operators can turn ordinary browsing and social media feeds into channels for attacks without requiring victims to download an application or deliberately open a suspicious link.
One confirmed incident involved a malicious Instagram advertisement themed around the football World Cup. iVerify detected a DarkSword variant known as P7 infecting an employee’s phone at a customer organisation while the employee scrolled through the Instagram feed. The advertisement was associated with the domain ad-track. live. The case demonstrated infection during passive scrolling.
The same employee subsequently encountered a separate attack involving another DarkSword variant after following a malicious link. Alerts enabled the organisation’s security team to rotate compromised credentials before they could be sold or used to enter its corporate network, iVerify said.
The investigation also uncovered a wider operation called DeadTag, which exploits domain names formerly used by advertising and analytics services. Website operators sometimes leave third-party tracking tags embedded in their pages after the associated services close or their domains expire. Criminals can register those abandoned domains and gain control of content automatically loaded by websites still referencing them.
Report URI found that operators were using this access to redirect visitors towards scams and to identify iPhone users eligible for spyware attacks. The researchers described the method as a half-click attack: merely visiting an affected page, or encountering a malicious advertising element, can trigger exploitation when the phone runs susceptible software.
The distinction is significant because users need not interact with a fraudulent advertisement. The malicious component can execute as the page loads, while the surrounding website appears legitimate. Successful infection nevertheless depends on technical conditions, including the device’s operating system version; the number of visitors exposed cannot be equated with confirmed infections.
The firms identified hundreds of expired domains brought back under criminal control and embedded across thousands of websites. Their assessment placed monthly visits to websites potentially capable of serving the spyware at approximately 135 million. That figure measures possible exposure through affected web properties, not the number of compromised phones. More affected sites may remain unidentified, with investigators continuing to examine the network.
Investigators also discovered DarkSword delivery code planted on hundreds of online shops using the PrestaShop ecommerce platform. The malicious loader was concealed in a directory resembling ordinary analytics infrastructure. Another clothing retailer was found loading both exploit kits, while related servers pointed to additional websites involved in distribution.
The spyware can seek passwords stored in Apple’s keychain, account information and cryptocurrency wallet data. Researchers identified targeting of wallet applications including Coinbase Wallet, Trust Wallet, OKX, Bitget, TronLink and Bitpie. Such access can enable theft of digital assets or expose credentials useful for further intrusions. The tools can also retrieve messages and contacts.
Responsibility for DeadTag remains unknown. Report URI found Chinese-language comments in code associated with a separate exploit operator, alongside infrastructure and wallet targets linked to Chinese-speaking cryptocurrency users. The researchers cautioned that these indicators do not establish the nationality or location of those responsible.
Google’s Threat Intelligence Group had previously documented Coruna as a collection of five exploit chains containing 23 exploits, affecting iOS versions 13.0 through 17.2.1. It separately identified DarkSword attacks against versions 18.4 through 18.7, involving six vulnerabilities. Both tools have circulated among different operators, including surveillance and financially motivated groups.
The latest investigation does not establish that current, fully patched iPhones are vulnerable to the demonstrated chains. Security updates addressing known weaknesses remain an important defence, while organisations face the additional task of identifying obsolete external scripts that continue to load from domains they no longer control.
Report URI said the DeadTag operation appeared unusually concentrated on European domain extensions rather than the more common. com addresses. Investigators also observed placeholders in the distribution infrastructure for future iOS versions, although attempts they examined to adapt the exploit kits for newer software were largely unsuccessful. The infrastructure could accommodate additional payloads as attackers change their methods.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
