iPhone Crypto Theft Via Websites: DeadTag and Wallet Risks

Security researchers have traced an alleged iPhone crypto theft via websites operation to a group they call DeadTag. Legitimate web pages are the delivery vehicle, and the payload is spyware aimed at older, unpatched Apple devices. On October 22, Axios described attacks that can infect iPhones without victims clicking a malicious link .

The threat arrives through ordinary browsing. Scott Helme, founder of Report URI, found the code across at least 6,600 legitimate websites pulling a combined 49 million monthly visits, according to an account of the researchers’ findings . For crypto holders, the worry is spyware built to reach wallets on the handset.

🔷 How iPhone Crypto Theft via Websites Turns Legitimate Pages Into Spyware Delivery

🥇 Why Avoiding Suspicious Links May Not Stop This Attack

🔷 DeadTag Allegedly Sells Access to Other Attackers

📱 Coruna and DarkSword Target Older iOS Devices

🧩 What the Website Network Means for Crypto Holders

📱 The Earlier Fake Ledger App Case Shows Another Route to Wallet Theft

👥 Earlier Fake Wallets Reached Users Through Stores and Ads

⚠️ Risks for Users and the Takedown Work Ahead

How iPhone Crypto Theft via Websites Turns Legitimate Pages Into Spyware Delivery

DeadTag allegedly buys up expired domains and takes over abandoned script references embedded in legitimate websites. Those references give the group a route back into pages whose operators may no longer maintain every outside service their sites load.

Related: SlowMist Finds PHP on 793 Crypto Domains as Emergency Security Fixes Land

That neglected infrastructure is what the alleged operation exploits to distribute malicious code. A visitor lands on a familiar website, and the page quietly connects to infrastructure now controlled by an attacker.

Forbes described hundreds of websites unknowingly participating in a spyware delivery network , with tens of millions of monthly visits. The trick hands attackers an established audience without having to persuade each visitor to open a newly created malicious site.

The weakness lives in old tracking links and outside scripts that stay active after their original owners abandon them. For website operators, that turns the ownership and maintenance of those dependencies into part of the security problem.

Why Avoiding Suspicious Links May Not Stop This Attack

The alleged infection route is a visit to a compromised page. The detailed account describes attacks that need no separate malicious-link click and no file download, which puts the exposure inside a browsing session that otherwise looks routine.

Rocky Cole, chief executive and co-founder of mobile security company iVerify, put the danger bluntly: “They’re just scrolling and being infected.” His warning centers on users encountering compromised content while browsing legitimate websites.

The attack moves attention away from the message that brought someone to a website and toward the software loaded once the page opens. Recognizing a website’s name is a weaker defense when a neglected tracking reference can drag attacker-controlled code into that page.

For holders using wallets on the same phone, the alleged objective is direct financial theft. Researchers describe spyware meant to siphon assets from targeted handsets, which makes device security relevant even when a user has dodged an obvious wallet scam.

DeadTag Allegedly Sells Access to Other Attackers

DeadTag is the tracking name researchers use for the group allegedly assembling the delivery infrastructure. The account describes a commercial operation that sells access to other hacking groups hunting routes into consumer devices.

That arrangement splits maintenance of the compromised web infrastructure from deployment of any particular spyware. A network of abandoned links becomes a distribution channel for buyers who bring their own attack tools.

The group allegedly registers as many as 10 new domains each week. Fresh registrations keep the operation stocked with infrastructure while researchers and security organizations work to disrupt existing routes.

Weekly activity also makes removal a never-ending task. Taking down one domain handles that slice of the delivery network, while other abandoned references and newly registered domains keep the broader operation alive.

Coruna and DarkSword Target Older iOS Devices

DeadTag’s customers deploy exploit kits called Coruna and DarkSword, according to researchers. The detailed account describes them as sophisticated tools believed to have leaked from state intelligence operations into commercial cybercrime; that origin remains an attributed assessment.

Deploying those kits drags espionage-grade tools into financially motivated attacks. Buyers get access to compromised websites, then point the exploits at visitors running vulnerable software.

The attackers are described as deliberately hunting older, unpatched iOS builds. That makes keeping the operating system current directly relevant to the weakness the alleged campaign seeks to exploit.

Coruna had already drawn attention in a March 5 warning crypto wallets. CCN’s account of Google’s warning identified MetaMask and Phantom among the targets on older iOS devices, placing the October website campaign in a broader history of mobile wallet attacks.

What the Website Network Means for Crypto Holders

Digital asset wallets on targeted handsets are the attackers’ main financial objective, per the researchers’ account. The practical exposure sits with the phone used to access those wallets and the software vulnerabilities available to the exploit kits.

Operating system maintenance becomes an immediate concern for retail holders who browse and manage crypto on the same device. The alleged route begins with web content, so caution around wallet downloads addresses only part of the threat described by researchers.

At least 6,600 websites give the alleged operation plenty of potential entry points. Their combined audience of 49 million monthly visits explains why abandoned web infrastructure is valuable to groups selling access to other attackers.

This distribution model puts website owners alongside phone users in the defensive response. Owners can clean up neglected script references on their pages, while users can address the outdated iOS software the exploit kits are described as targeting.

The Earlier Fake Ledger App Case Shows Another Route to Wallet Theft

In a separate case, blockchain investigator ZachXBT traced $9.5 million in stolen crypto to a fake Ledger wallet app downloaded through Apple’s App Store. DL News detailed losses affecting more than 50 suspected victims between April 7 and April 13 .

Apple said it removed the app because of its bait-and-switch functionality and suspended the developer’s account. The stolen assets included Bitcoin, Solana, Tron and other cryptocurrencies.

Defending its broader screening record, an Apple spokesperson said the company rejected over 320,000 app submissions in 2024 that were spam or copied other apps. The spokesperson also said Apple took action to prevent over 37,000 potentially fraudulent products from reaching App Store users. Ledger did not immediately respond to questions the fake wallet case.

ZachXBT’s investigation also followed the movement of stolen funds, reporting that assets were moved from KuCoin exchange addresses and laundered through a centralized mixer called AudiA6. Three victims accounted for a combined $7.25 million in losses, mostly in USDC ▼ $0.9996 and USDT ▼ $0.9991 .

Musician G. Love said he lost 5.9 BTC ▼ $81,532.00 after downloading the malicious app and entering his seed phrase. The fake wallet persuaded a user to hand over sensitive information during what appeared to be a legitimate setup process.

The musician said the theft happened while he was switching his Ledger over to a new computer. “All my BTC gone in an instant,” he wrote on X, describing the loss as his retirement fund. He said he had been involved in crypto since 2017 and that the scammers caught him off guard. Neither he nor his management responded to questions.

The website campaign presents a different security problem: researchers describe spyware delivered through browsing and aimed at vulnerable iPhones. Together, the cases put both trusted distribution channels and the device itself under scrutiny when users manage digital assets.

Earlier Fake Wallets Reached Users Through Stores and Ads

The April case followed earlier thefts involving impersonated wallet software. In 2023, ZachXBT flagged losses of over half a million dollars in Bitcoin after users downloaded a fake Ledger wallet from the Microsoft App Store. That incident extended the history of wallet impersonation beyond Apple’s distribution platform.

Also in 2023, billionaire Mark Cuban lost nearly $900,000 in crypto after accidentally downloading a fake version of MetaMask advertised on Google. He only realized he had been targeted after a reporter contacted him the attack. Those earlier incidents involved users obtaining deceptive software; the October researchers describe an infection route through content loaded during ordinary web browsing.

Risks for Users and the Takedown Work Ahead

Keeping iOS updated directly addresses the older, unpatched devices identified as targets. Users should also treat wallet setup requests carefully: the April fake Ledger case involved a seed phrase entered into a malicious app obtained through an established storefront.

The combined lesson is practical. A familiar website can contain an abandoned script reference, and an app marketplace can contain a deceptive wallet application. Protecting funds requires attention to the software on the phone as well as the wallet credentials used on it.

Helme is coordinating with national cybersecurity organizations to accelerate takedowns. The number of affected websites makes notifying operators complex, particularly when the malicious connection comes through an old service rather than a website’s main content.

Forensic work also identified Chinese-language command scripts and domains routed through Chinese internet security infrastructure. Those technical details form part of the investigation into the alleged delivery network and its efforts to resist disruption.

The developments to watch are the takedown effort, the removal of abandoned script references and the group’s continued domain registrations. Each affects how much access the alleged network can offer buyers seeking vulnerable iPhone users.

What does “drive-by infection” mean in this iPhone case?

It describes spyware reaching a device through a web page the user visits, without a separate file download or malicious-link click. Researchers say the alleged DeadTag network uses compromised references inside legitimate websites to create that exposure.

Which crypto wallet names have appeared in Coruna warnings?

A March 5 account of Google’s Coruna warning named MetaMask and Phantom as targets on older iOS devices. That earlier warning concerned the exploit kit also identified in the October account of the website delivery network.

Who is Scott Helme, and what is his role?

Helme is the founder of Report URI and the security specialist credited with identifying code across at least 6,600 websites. He is working with national cybersecurity organizations to speed up takedowns.

What happened to the fake Ledger app’s developer account?

Apple said it suspended the account and removed the app because of its bait-and-switch functionality. The April case involved a malicious wallet application, while the October allegations concern spyware distributed through websites.

Which losses were concentrated in the April fake-wallet case?

ZachXBT identified three victims whose combined losses reached $7.25 million, mostly in USDC and USDT. His investigation put the total stolen through that app at $9.5 million across more than 50 suspected victims.

This article is for information only and is not financial advice.