What happened: Cybersecurity researchers have uncovered the sprawling 'DeadTag' operation, which exploits over 660 expired website domains. Attackers buy these abandoned domains to inherit traffic from websites that still load old third-party scripts. The operation uses advanced iOS exploit kits like Coruna and DarkSword to target iPhone users silently—requiring no clicks, downloads, or warnings just by opening an infected page or scrolling through an Instagram ad.
Why it matters: This poses a direct threat to crypto investors. The spyware is specifically engineered to target cryptocurrency wallet applications, extract private keys, and steal sensitive credentials, putting mobile crypto holdings at high risk without users even realizing they’ve been compromised.
