How Forgotten Website Tags Became a Delivery Network for iPhone Spyware

Report URI and iVerify describe DeadTag, an operator buying expired domains behind abandoned analytics and ad tags, so sites still loading those tags serve its roughly 2 KB script. The researchers count 660+ domains, thousands of sites and an estimated 135 million monthly visits. The script filters out bots and sells traffic, including to a crew delivering Coruna and DarkSword iPhone exploits. These figures come from the researchers alone. Builders should audit third-party tags and deploy a Content Security Policy.