The most alarming story in cybersecurity news today is not a hacked app or a phishing email. It is the websites you already trust. Researchers at Report URI and iVerify disclosed on October 22, 2026 that attackers bought roughly 630 expired domains that nearly 8,000 legitimate websites still load code from — forgotten chatbot widgets and analytics tags their owners never removed. Whoever owns the domain now decides what that code does, and on 248 sites it serves iPhone spyware. No click is needed: visiting the page is enough. A second campaign infected a phone through an Instagram ad that ran its exploit code the moment the ad appeared on screen. Two checks below — one for your iPhone, one for your website — take under a minute each.
Put plainly: at least 6,600 legitimate websites are loading code from domains their owners no longer control, and the network behind those domains can reach more than 100 million visits a month on iVerify's count. Nobody hacked those sites one by one. The trust was the exploit — a script tag a developer pasted years ago kept its authority long after the company behind it walked away.
iVerify's half of the disclosure needs no website at all. An employee of a financial institution had their iPhone infected after scrolling past an Instagram advertisement about professional soccer. The malicious code started running when the ad rendered on screen — before any tap. It checked the phone's iOS version, deployed a matching exploit, stole the employee's login credentials, and searched the phone's cryptocurrency wallets. Both campaigns share the same shape: the malicious code executes inside content the victim was going to encounter anyway, then picks only the phones it can actually break into.
The payloads in both campaigns are the Coruna and DarkSword exploit-and-spyware kits, aimed at credentials and cryptocurrency — iVerify found them hunting wallets including Bitpie, TronLink, OKX and Bitget, all popular with Chinese-speaking users. The kits' code carries comments in simplified Chinese, including in the loader logic that stops the attack running twice on the same phone, and the exploit pages report back with affiliate "channel codes" that credit whichever group sent each victim. That is why researchers describe the operation as suspected — their word, and this page keeps it — financially motivated and Chinese-speaking. It is a reading of the evidence, not an identification.
Every prior spyware story in this series asked readers to protect a phone. DeadTag adds a second victim: the website owner. If your site loads a tag from a domain that has since expired and been re-registered, your pages are distributing whatever the new owner wants — spyware today, spam redirects tomorrow — under your brand, to your visitors, with your reputation absorbing the blame. The fix is unglamorous and entirely in your control: inventory every external domain your site loads, and delete the ones nobody can explain. A domain inventory is also the only way to find out whether you are already in the network, because the researchers notifying thousands of owners one at a time will not reach everyone quickly.
Answer three questions. Everything runs in your browser; nothing is sent anywhere. This is a risk read based on the researchers' findings — not a scan of your device, and no web page can scan your iPhone.
Paste the external domains your site loads scripts or tags from — one per line (chat widgets, analytics, tag managers, embeds, consent tools). Then answer three questions about how well you know that list.
Honest scope: this tool scores inventory hygiene only. It cannot check live domain registration from your browser — verifying who owns a domain today takes a registrar or WHOIS lookup, and that lookup is the step that actually catches a DeadTag domain. A clean score here means your list is tidy, not that every domain on it is safe.
DomainGuard — Ingenious AI's domain-impersonation and domain-risk defense — exists for the half of DeadTag that happens to website owners: the domains you trust, the domains you own, and the lookalikes in between, watched for expiration, takeover, and impersonation before a criminal turns them into a delivery network. Get early access on WhatsApp. For the phone side of the story, BreachHunter tracks the intrusion signals that follow a spyware delivery wave.
1. How does DeadTag get spyware onto an iPhone?
2. What made the Instagram ad infection unusual?
3. What is the core defense for iPhone owners?
4. You run a website. Which finding is the biggest red flag?
5. What do researchers actually know about who runs these campaigns?
DeadTag is the name Report URI's researchers gave to a criminal delivery network built on expired internet domains. Attackers bought roughly 630 expired domains that thousands of legitimate websites still load code from, through forgotten chatbot and analytics tags. When an iPhone visitor reaches one of those sites, the code can check the phone and serve spyware — no click needed.
The site itself was never hacked in the usual sense. Years ago its developers added a third-party script — a chat widget, an analytics tag — loaded from an outside domain. The vendor let that domain expire, an attacker re-registered it, and the site kept loading code from it. Whoever controls the domain now controls what that script does in every visitor's browser.
Coruna and DarkSword are iPhone exploit-and-spyware kits. Once served to a vulnerable phone, they work to steal data — in these campaigns, login credentials and cryptocurrency. iVerify found the kits hunting for wallets including Bitpie, TronLink, OKX and Bitget, and the code reports back with affiliate channel codes so the operators can credit whoever sent each victim.
Update iOS — that is the core defense. iVerify says attempts to retool these kits for current iOS versions are mostly non-functioning for now, so a fully updated phone is a hard target. If you hold crypto or are otherwise high-risk, enable Lockdown Mode, which shrinks the attack surface further. Click discipline does not help here, because no click is required.
Inventory every external domain your pages load scripts or tags from, then check each one: do you still use the service, do you know who owns the domain today, and is it still registered to that owner? Dead widgets are the danger — a chat or analytics tag nobody on your team can identify should come off the site until it is explained.
Sources: Report URI, "DeadTag: How Forgotten Website Tags Became a Delivery Network for iPhone Spyware," October 22, 2026 (Scott Helme — the ~630 expired domains, the 6,600-site and 248-site counts, the up-to-10-new-domains-a-week pace, and the commercial traffic-delivery reading of the crew) · iVerify, "Dead Domains, Live Exploits," October 22, 2026 (the Instagram ad infection of a financial-institution employee, the 135 million monthly visits count, the wallet targets, and the state of retooling attempts for current iOS) · Forbes, October 22, 2026 (Thomas Brewster — hundreds of infected websites with tens of millions of monthly visits acting as an iPhone spyware delivery network) · Axios reporting on the two campaigns, October 22, 2026, as carried in secondary coverage.