What changed
On October 21–22, 2026, Report URI and iVerify described DeadTag, a traffic brokerage operation built from expired third-party analytics and advertising domains that website owners had never removed from script tags. Report URI reports 660-plus re-registered domains still referenced by thousands of websites and estimates 135 million visits monthly across the affected footprint; that is exposure, not 135 million infections. Most redirected traffic leads to scams or advertising; a selectively targeted subset of vulnerable iPhones reaches a fake prediction-market page serving Coruna for iOS 13–17.2.1 or a modified P7 DarkSword for iOS 18.4–18.7. iVerify independently investigated the device-side exploits and reported an additional malicious Instagram-ad delivery route. The attack on sites often requires no compromise of their servers: the attacker controls a once-trusted script domain after it expires.
Why it matters
Site owners who leave defunct analytics, ad, chat or widget scripts in production HTML have effectively delegated script execution to whoever later registers the old vendor domain. The attack can bypass routine site-integrity checks because the original HTML is unchanged and selective payloads evade crawlers. For builders, agencies and small SaaS operators this creates a practical audit task: inventory third-party scripts, remove abandoned includes, watch unexpected script changes and deploy restrictive Content Security Policy where workable. For users of older iOS versions, the research documents a real browser exploit delivery path, not merely a phishing prompt.
How an expired script domain becomes a live attack
An analytics or advertising vendor shuts down, but its <script src> reference stays in a customer's site. The vendor's domain expires, is purchased by the DeadTag operator, and begins serving new JavaScript to the same legitimate pages. Report URI tracked more than 660 such domains. The estimate of 135 million monthly visits refers to the exposed traffic footprint; neither the number of actual redirects nor successful device compromises is established.
Selective redirection hides the operation
The roughly 2 KB loader screens out bots and security scanners, then asks a control server how to handle a visitor. Report URI had to rotate residential IP connections to observe malicious destinations. Researchers saw fake VPN prompts, surveys, ad redirects, gambling and crypto pages, and a route to iPhone exploit kits. It is inaccurate to say every visit to an affected site loads spyware.
Two exploit kits target older iOS versions
The malicious route selected Coruna for iOS 13–17.2.1 and a modified P7 DarkSword for iOS 18.4–18.7. Both target browser vulnerabilities and can attempt to extract keychain credentials, cryptocurrency-wallet data and device information without requiring an additional tap once a vulnerable browser loads the malicious page. iVerify's device forensics and Report URI's delivery-chain research provide complementary evidence. Patched current iOS versions are not established as vulnerable to these observed chains.
The supply-chain risk extends beyond DeadTag
Researchers also identified DarkSword loaders directly planted on hundreds of PrestaShop stores, a separate compromise route that should not be confused with the expired-domain mechanism. A related malicious Instagram advertisement was independently observed by iVerify. The DeadTag domain buyer's identity is unknown; Chinese-language code clues relate to the exploit operator and are not proof of nationality.
What operators can do now
Audit every external script URL and identify who currently owns the domain; remove dead analytics and advertising tags, check DNS and current responses, and monitor for newly loaded domains or unexpected script changes. Apply a deliberately scoped Content Security Policy, noting that a compromised already-allowlisted domain can still execute code, and consider Subresource Integrity for immutable third-party resources. Keep mobile devices updated; high-risk iPhone users can consider Lockdown Mode.