DeadTag turns abandoned website tags into iPhone attack paths

Expired domains behind old analytics and advertising tags have been bought and repurposed to redirect visitors to malicious content, including the Coruna and DarkSword iOS exploit kits. Report URI and iVerify describe a chain that filters visitors and tailors its payload to the device; security scanners may receive only an empty response.

The case shows how a forgotten third-party script remains an active dependency: its domain can change hands without any site change. The article recommends auditing tags, monitoring loaded scripts, and restricting their domains with a Content Security Policy.