There is a new dark web toolkit that cybercriminals have been actively using since spring 2026. Dubbed DeadTag, this toolkit allows operators to target users with customized campaigns. One crew is using it to distribute crypto-stealing spyware. No click. No email. And no download.
DeadTag is in the web traffic redirect business. Estimates say it moves 135 million users every month through its network, with a focus on EU domains for now. Most cybercriminals who are using DeadTags redirect users to online scams, fake giveaways, and online crypto casino scams. However, one of the threat actors using DeadTag, dubbed “the iPhone exploit crew,” stands out for redirecting iPhone users to highly sophisticated spyware like Coruna and DarkSword — spyware that, until recently, was only used by nation-state threat actors.
Let’s look at how DeadTag and the iPhone exploit crew work and how to keep your data and crypto safe.
Your Mac is the target, too
DeadTag is selling web traffic from millions of monthly users to cybercriminals
A recent iVerify and Report URI investigation uncovered a dark web cybercriminal operation they dubbed DeadTag, generating millions of monthly visitors and selling the traffic to scammers, cybercriminals, and a crew that breaches iPhone users with spyware to steal their crypto.
In this operation, the report says DeadTag is buying up abandoned online ad industry sites that thousands of sites have used before and included code from them in their sites as “tags.” These tags, now in the hands of DeadTag, can be modified. The modified version can perform redirects, fetch code, track user data, and load malicious ads.
Ads are also being displayed to users via Instagram. However, iVerify says it is unclear how they are bypassing Meta’s ad-vetting processes.
“Perhaps they have completely obfuscated their presence in the highly complex networks of sellers and resellers, or they have compromised one of the vendors in the system, giving them the ability to push their own code,” says iVerify. “It could be as simple as taking advantage of the scale of Meta’s operation, slipping malicious content through that is then later flagged and removed.”
As mentioned, DeadTag is in the dark web traffic business. Most of the cybercriminals using it are redirecting iPhone users to low-level scam sites, such as fake online crypto casinos or fake giveaways.
Report URI says they identified over 660 expired and re-registered domains being abused this way. The code is embedded on literally thousands of websites, generating a “cautiously estimated 135 million visits a month.”
While experts say this campaign is financially motivated, the iPhone exploit crew, one of the DeadTag users, redirects iPhones to Coruna and DarkSword spyware that steals their data and crypto using zero-click malware delivery techniques.
Besides using DeadTag, the iPhone exploit crew is also hacking websites directly, planting DarkSword loaders on hundreds of online shops, all on the same French-based e-commerce platform, PrestaShop.
“The user isn’t visiting a malicious site,” Rocky Cole, co-founder and chief operating officer of iVerify, told Finance Biggo.
“They’re just scrolling, and they get infected,” says Cole, regarding the iPhone spyware exploit crew operations.
In the same report, Finance Biggo says there are at least 6,600 legitimate sites being exploited by DeadTags. Combined, they have a monthly traffic of 49 million. A total of 248 known sites, with monthly visitors of roughly 8 million, are used strictly to deliver spyware. Additionally, there are about 630 DeadTag-purchased domains and roughly 8,000 legitimate sites that redirect users to sites prepared by the cybercriminals.
One of the biggest takeaways from this threat campaign is the use of highly advanced spyware for common cybercrime and how the lines are being blurred between the techniques and tools used by nation-state threat actors, cybercriminals, and scammers. For example, CitizenLab recently found that one platform, AdFection, was also using ad tools to redirect users to spyware. But in that case, the targets were high-level individuals in government, energy, tech, and other critical industries.
In the case of DeadTag’s iPhone crew, URI Reports says their spyware is “built to steal”:
- Passwords and secrets from the iPhone’s keychain
- Crypto wallet apps, including Binance, Coinbase Wallet, OKX, Bitget, Trust Wallet, Exodus, TronLink and Bitpie
- Device and account information, sent back to the attackers’ server
“A reboot of the phone may stop the active implant,” says the report. “But even if it does, by then, it’s probably far too late.”
The iPhone exploit crew appears to be using an exploit that only works on vulnerable iPhones that have not been updated. However, iVerify’s report notes that an update is being developed, with little progress so far.
Fake VPNs, lookalike sites, hacked e-commerce stores, and “You Won,” crypto, and casino scams
What you see on your screen will vary depending on what the cybercriminal using DeadTag wants you to see. According to the reports, DeadTag operators can modify the tags linked to the abandoned ad industry sites to redirect users to sites and display ads.
Everything happens inside the browser. Once you land on an affected website, the tag will check that you are a real person and not a search engine, a security scanner, or an automated browser or bot. If the tag gets a “you are human” response, the attacker’s server will decide where to send you. It will also decide, based on the data it gathered from your machine, whether launching an attack is worth it.
“The chosen ones get redirected, presumably auction-style, to the highest bidder,” says Report URI. “Visitors can be sent on to anywhere DeadTag chooses.”
So, according to the reports, when starting from an impacted site, you may end up on:
- A fake “this video isn’t available in your country, use a VPN” pop-up pushing a VPN install
- Fake surveys and “you’ve won” prize pages
- Search-advert pages for car deals and dentists
- A decoy redirect to Google
- Betting and crypto-casino scam sign-up pages
- Or the iPhone exploit kit
For the iPhone crew cyberattack, reports show that it redirects users to a fake Polymarket prediction-market page.
On the other hand, the iPhone exploit crew has hacked hundreds of e-commerce stores from PrestaShop. And it could pivot to other similar e-commerce-style stores as the holiday season moves in.
iVerify added that the infrastructure of the iPhone exploit crew and the spyware it is using is also connected to hundreds of Chinese-language crypto exchanges, USDT and Tron payment sites, gambling sites, and lookalikes of Chinese shopping and travel brands. The selection of wallets targeted by the spyware leans heavily toward ones popular with Chinese-speaking crypto users. These include Bitpie, TronLink, OKX, and Bitget.
iVerify says it is unclear who is behind DeadTags. While Chinese-speaking language and infrastructure are linked to the iPhone exploit crew, URI Reports notes “none of that is proof.” But “at least reads like a financially motivated, Chinese-speaking crypto-theft operation.”
According to the report, it’s safe to assume “that they’re either Chinese, or they really want us to think that they’re Chinese.”
Why are cybercriminals using nation-state spyware for crypto theft?
iVerify says that the shift to using spyware—previously reserved for nation-state threat actors, customized to target everyday average users in crypto heist threat campaigns—is notable. The question is why? Why are they using spyware and not common stealers?
“Because it’s a business decision, not a technical one,” says Kevin M. Coles, Fractional CIO and Founder, Coles Technical Group.
A cheap stealer needs the victim to download something, and that’s where most attacks die, Coles explains. These kits skip that step completely. The person just loads a page.
“When you’re going after crypto wallets, one good hit can be worth more than the whole operation costs,” says Coles. “When the payout is that big and that final, paying for a high-end exploit is just a smart investment for them,” says Coles.
“They’re renting traffic from thousands of hijacked sites, so a tool that works on load turns all of those visits into chances,” says Cole. “That math only works with a kit that doesn’t need the victim’s help.”
Shlomi Beer, Co-Founder and CEO of ImpersonAlly, agrees.
“The payoff justifies it,” says Beer. “When the targeting already filters for crypto users and online shoppers, a reliable iPhone exploit is a far better investment than a basic stealer that iOS would block anyway,” says Beer.
Website owners should check their tags
iVerify and Report URI called on website owners to check their HTML code and make sure there are no abandoned tags.
“For website owners, open your site and look at every third-party script it loads,” Coles says.
Most sites are still pulling code from analytics and ad services they canceled years ago, Coles adds. When that domain expires, someone else can buy it, and now they own a piece of your website.
“Remove what you don’t use, keep a list of what you do, and set a Content Security Policy so your site only loads code from places you approved,” Coles says.
What can you do to stay safe from DeadTag and spyware built for crypto heists?
Below, you’ll find some tips and suggestions on how to stay safe from DeadTag and operators like the iPhone crew who use this dark web platform to deploy spyware customized for crypto heists.
For scam sites, it’s about a little awareness and safe digital habits
While scam sites tied to the DeadTag investigation are a concern for users, simply closing the browser, not downloading anything from unverified sites, using ad blockers and privacy-first browsers, and not typing in your passwords or data on untrusted sites should do the trick.
The biggest risk is zero-click spyware ads
However, when it comes to spyware like Coruna and DarkWeb, things get more challenging. Malicious zero-click spyware threat campaigns have used different techniques to breach iPhone users. These techniques either embed malicious code directly into ad videos, website logos, images, or ads, or they code ads for them to fetch scripts from attackers’ servers. Malicious sites can do the same.
Apple is constantly issuing new updates to patch up the vulnerabilities that make these techniques possible. But usually, the scripts are coded to break the sandbox, the isolated environment of your browser, and access your memory to run code.
A few tips can help you stay on the safe side from spyware. Update your device to get the latest spyware vulnerability patches from Apple or other companies. Turn on Lockdown Mode if you think you have been breached by spyware, and use MFA and biometrics if possible on your crypto wallets. This way, even if an attacker breaches your device, they will need more than your password, data, or files to access your accounts. So, secure your crypto.
Privacy-first browsers, trusted VPNs, and ad blockers can also help you strengthen your cybersecurity posture. And if you notice a redirect or something taking over your screen, close the browser before it loads.
Get Moonlock. It will flag new and old threats, including crypto stealers and spyware.
Having a trusted cybersecurity backup for your Mac can help you build a stronger defense. The Moonlock antivirus for Mac is built to offer you layers of defense through various features.
Real-Time Protection checks everything you interact with for malware, from emails to online downloads to terminal scripts. And the customizable Malware Scanner runs on a constantly updated malware and threat database. This means you get the latest protection even before updates are rolled out.
If Moonlock flags a threat or a suspicious file in real time, or if it is found during a malware scan, it will tell you what it is and why it is dangerous. It will then move the threat to Quarantine, where it is fully isolated and can do no harm. You can check out Quarantine on your own schedule to learn more about the threats your Mac has encountered.
Additionally, Moonlock ships with a Scam Detector that you can use to check for scams and phishing on every text or email, a VPN for safe browsing, a Security Advisor to help you build safe digital habits at your own pace, and a Network Inspector to block servers in specific countries. Plus, the System Protection tool scans your Mac’s settings and guides you on how to turn them up.
You can check out and test-drive Moonlock for free for 7 days.
Final thoughts
Dark web actors have developed and deployed ad tools that can be customized to target specific groups of users and can integrate the malicious infrastructure and malware of choice for the cybercriminal actors who use these tools. They are using these tools to run all kinds of campaigns, from common scams and fraud to phishing sites, fake app downloads, and even spyware retrofitted for crypto theft.
To stay safe, follow the news and tips from experts. Learning more about how your technology works can help you build up your security and privacy posture.
This is an independent publication, and it has not been authorized, sponsored, or otherwise approved by Apple Inc. Mac, iPhone, and iOS are trademarks of Apple Inc.
