# DeadTag turns abandoned website tags into iPhone attack paths

Canonical source : [DeadTag turns abandoned website tags into iPhone attack paths](<https://sebastien.rigaux.be/en/tech-watch/links/deadtag-turns-abandoned-website-tags-into-iphone-attack-paths>)

Expired domains behind old analytics and advertising tags have been bought and repurposed to redirect visitors to malicious content, including the Coruna and DarkSword iOS exploit kits. Report URI and iVerify describe a chain that filters visitors and tailors its payload to the device; security scanners may receive only an empty response.

The case shows how a forgotten third-party script remains an active dependency: its domain can change hands without any site change. The article recommends auditing tags, monitoring loaded scripts, and restricting their domains with a Content Security Policy.

- Selected on : 2026-10-29

- Resource publication : 2026-10-22

- Entry updated : 2026-11-07T20:32:37+0000

- Format : Article

- Source language : EN

- Credit : Scott Helme

Original resource : [DeadTag turns abandoned website tags into iPhone attack paths](<https://blog.report-uri.com/deadtag-how-forgotten-website-tags-became-a-delivery-network-for-iphone-spyware/>)

Tags : [Security](<https://sebastien.rigaux.be/en/tech-watch/tags/security>) · [Dependency management](<https://sebastien.rigaux.be/en/tech-watch/tags/dependency-management>) · [JavaScript](<https://sebastien.rigaux.be/en/tech-watch/tags/javascript>)

Available versions : [Français](<https://sebastien.rigaux.be/veille/liens/deadtag-des-tags-web-abandonnes-detournes-contre-les-iphone>) · [English](<https://sebastien.rigaux.be/en/tech-watch/links/deadtag-turns-abandoned-website-tags-into-iphone-attack-paths>)

[Back to tech watch](<https://sebastien.rigaux.be/en/tech-watch>)