Researchers Trace Alleged DeadTag iPhone Spyware to 6,600 Websites

Security researchers have tracked an alleged iPhone crypto-theft operation run by a group they have named DeadTag, utilizing mainstream websites to deliver spyware to older, unmanaged Apple devices. Axios reported on October 22 that these attacks can compromise iPhones even when victims do not click on malicious links.

This threat is encountered during normal web browsing. Scott Helme, founder of Report URI, discovered the malicious code on a minimum of 6,600 authentic websites that generate roughly 49 million monthly visits combined, according to research accounts. For cryptocurrency owners, the main concern is spyware specifically designed to access digital wallets stored on mobile devices.

How iPhone Crypto Theft via Websites Turns Legitimate Pages Into Spyware Delivery

DeadTag allegedly purchases expired domain names and hijacks abandoned script references embedded within legitimate web pages. These outdated references provide the group with a backdoor into sites whose operators may no longer routinely audit every external third-party service their pages load.

Related: SlowMist Finds PHP on 793 Crypto Domains as Emergency Security Fixes Land

This neglected digital infrastructure is leveraged by the alleged network to distribute malicious software. When a visitor arrives at a recognized, trusted website, the page quietly establishes a connection with infrastructure now overseen by malicious actors.

Forbes highlighted that hundreds of websites are unwittingly participating in this spyware delivery framework, reaching tens of millions of monthly visitors. This tactic provides perpetrators with an established web audience, eliminating the need to trick each visitor into clicking a newly created malicious website.

The vulnerability exists in legacy tracking links and third-party scripts that remain active long after their original creators abandon them. For website owners, managing and auditing these external dependencies has consequently become an essential component of overall web security.

Why Avoiding Suspicious Links May Not Stop This Attack

The primary infection vector is simply viewing a compromised web page. Detailed reports indicate that the attacks require neither a separate malicious-link click nor any file download, exposing users during browsing sessions that otherwise appear completely routine.

Rocky Cole, chief executive and co-founder of the mobile security firm iVerify, described the hazard directly: “They’re just scrolling and being infected.” His warning focuses on users encountering malicious content while simply viewing trusted websites.

This threat shifts security awareness away from the messages or links that direct someone to a site and toward the code executed automatically as the page renders. Simply recognizing a website’s domain name offers limited protection when an unmaintained tracking reference can pull attacker-controlled code directly onto that page.

For individuals managing crypto wallets on the same smartphone, the alleged goal is direct financial theft. Researchers note that the spyware is intended to extract assets from targeted handsets, meaning device security remains critical even if a user manages to avoid traditional wallet scams.

DeadTag Allegedly Sells Access to Other Attackers

DeadTag is the identifier utilized by researchers for the collective accused of building this delivery network. Accounts describe a commercial operation that sells access to other malicious groups looking for entry points into consumer smartphones.

This structure separates the upkeep of compromised web infrastructure from the actual deployment of individual spyware payloads. A network of abandoned links thus functions as a ready-made distribution channel for buyers supplying their own exploit tools.

The group allegedly registers up to 10 new domains weekly. These frequent registrations keep the operation stocked with active infrastructure even as security organizations and researchers work to block existing pathways.

This weekly generation makes completely eradicating the threat a continuous challenge. Taking down one domain removes only a fraction of the delivery network, while other neglected references and newly acquired domains maintain the broader operation.

Coruna and DarkSword Target Older iOS Devices

According to researchers, customers of DeadTag deploy specialized exploit kits known as Coruna and DarkSword. Reports characterize these as sophisticated tools suspected to have originated in state intelligence operations before leaking into commercial cybercrime circles, though that origin is based on attribution assessments.

Using these kits introduces intelligence-grade capabilities into financially driven cyberattacks. Buyers gain access to compromised web pages and then target visitors running vulnerable software builds.

The attackers are reported to specifically target older, unpatched iOS versions. Consequently, keeping mobile operating systems fully updated directly addresses the vulnerability targeted by this campaign.

Coruna previously came to light in a March 5 security alert concerning crypto wallets. CCN’s coverage of Google’s warning highlighted MetaMask and Phantom as targets on older iOS devices, tying the October website campaign into a broader history of mobile-focused wallet attacks.

What the Website Network Means for Crypto Holders

Digital asset wallets residing on targeted mobile devices are the primary financial objective for the attackers, based on researchers’ findings. The practical risk centers on the smartphone used for asset management and the underlying software vulnerabilities exposed by these exploit kits.

Operating system updates are an immediate necessity for retail users who browse and handle cryptocurrency on their mobile devices. Because the attack vector initiates via standard web browsing, exercising caution exclusively around wallet downloads only guards against a portion of the threats outlined by researchers.

With at least 6,600 websites involved, the alleged operation has access to numerous potential entry points. Their cumulative audience of 49 million monthly visits explains why abandoned web infrastructure remains attractive to syndicates selling access to other hackers.

This distribution model requires website administrators and mobile users to share defensive responsibilities. Owners can purge neglected script references from their sites, while users can ensure their iOS software is patched against the exploit kits being targeted.

The Earlier Fake Ledger App Case Shows Another Route to Wallet Theft

In an unrelated incident, blockchain analyst ZachXBT traced $9.5 million in stolen cryptocurrency to a counterfeit Ledger wallet application hosted on Apple’s App Store. DL News reported that over 50 suspected victims suffered losses between April 7 and April 13.

Apple stated that it removed the application due to bait-and-switch behaviors and suspended the developer profile. The stolen assets included Bitcoin, Solana, Tron, and other digital tokens.

Highlighting its broader review metrics, an Apple representative noted that the company rejected over 320,000 application submissions in 2024 for being spam or duplicating existing apps, alongside blocking more than 37,000 potentially fraudulent items from reaching App Store users. Ledger did not immediately reply to inquiries regarding the counterfeit wallet incident.

ZachXBT’s inquiry also monitored the movement of the stolen funds, reporting that assets were transferred out of KuCoin exchange accounts and laundered via a centralized mixing service named AudiA6. Three separate victims accounted for $7.25 million of the total losses, primarily held in USDC and USDT.

Musician G. Love reported losing 5.9 BTC after downloading the fraudulent app and submitting his seed phrase. The fake wallet tricked the user into revealing sensitive information during what appeared to be an authentic setup procedure.

The artist stated that the theft occurred while he was migrating his Ledger setup to a new computer. “All my BTC gone in an instant,” he posted on X, describing the stolen funds as his retirement savings. He noted he had been active in crypto since 2017 and that the scammers caught him unawares. Neither he nor his representatives responded to further inquiries.

The website campaign poses a different security challenge: researchers detail spyware delivered via browsing sessions targeting vulnerable iPhones. Together, these events place both trusted distribution platforms and the underlying hardware under intense scrutiny for cryptocurrency users.

Earlier Fake Wallets Reached Users Through Stores and Ads

The April incidents followed previous thefts involving fraudulent wallet software. In 2023, ZachXBT reported losses exceeding half a million dollars in Bitcoin after users downloaded a counterfeit Ledger wallet from the Microsoft App Store, expanding the scope of wallet impersonation beyond Apple’s ecosystem.

Additionally, in 2023, billionaire Mark Cuban lost nearly $900,000 in crypto after mistakenly downloading a fake version of MetaMask advertised via Google. He only discovered the compromise after a journalist reached out to him regarding the attack. While those older cases involved users downloading deceptive apps directly, the October research highlights an infection vector relying on content loaded dynamically during routine web browsing.

Risks for Users-and-the-Takedown-Work-Ahead

Keeping iOS updated directly mitigates the risks associated with the older, unpatched devices targeted by these campaigns. Users should also exercise extreme caution regarding wallet setup instructions, given that the April fake Ledger incident involved seed phrases entered into a malicious application downloaded from an official storefront.

The collective takeaway is clear: a trusted website can harbor an abandoned script reference, and an app store can host a deceptive wallet application. Protecting financial assets requires remaining vigilant about both the software version running on the phone and the credentials used within crypto wallets.

Helme is collaborating with national cybersecurity authorities to expedite remediation efforts. The sheer volume of compromised websites complicates notification procedures, particularly when malicious connections operate via legacy scripts rather than a site’s core content.

Forensic analyses also identified Chinese-language command scripts and domains routed through Chinese network security infrastructure. These technical findings form a core part of the ongoing investigation into the alleged delivery network and its efforts to evade disruption.

Key developments to monitor include ongoing takedown operations, the removal of dormant script references, and the group’s ongoing domain registration activities. Each factor dictates the extent of access the alleged network can provide to buyers seeking vulnerabilities in iPhones.

FAQ

What does “drive-by infection” mean in this iPhone case?

It describes spyware reaching a mobile device simply by visiting a web page, without requiring a separate file download or a click on a malicious link. Researchers state that the alleged DeadTag network uses compromised references embedded inside legitimate websites to facilitate this exposure.

Which crypto wallet names have appeared in Coruna warnings?

A March 5 report regarding Google’s Coruna warning explicitly named MetaMask and Phantom as targets on older iOS devices. That early alert involved the same exploit kit later connected to the October website delivery network reports.

Who is Scott Helme, and what is his role?

Helme is the founder of Report URI and the security professional credited with discovering the malicious code across at least 6,600 websites. He is working alongside national cybersecurity entities to accelerate domain takedowns.

What happened to the fake Ledger app’s developer account?

Apple stated that it suspended the developer account and removed the app due to bait-and-switch functionality. The April incident involved a malicious wallet application, whereas the October findings involve spyware distributed through standard websites.

Which losses were concentrated in the April fake-wallet case?

ZachXBT identified three specific victims whose combined losses totaled $7.25 million, primarily in USDC and USDT. His investigation estimated the total amount stolen via that specific app at $9.5 million across more than 50 suspected victims.

This article is for information only and is not financial advice.