FHN 
Cybercriminals are using two iPhone exploit kits, Coruna and DarkSword, to access devices and collect sensitive information. The attacks can begin when someone visits a compromised website, without downloading an application or approving an installation.
Researchers from Zimperium’s zLabs team discovered a large network of websites distributing these exploits. Their investigation, published on October 29, 2026, identified 608 domains associated with Coruna-related attacks.
The malicious websites check which iOS version a visitor is running and use the corresponding exploit chain. Devices running iOS 17.2.1 or older are targeted with Coruna, while newer devices running iOS 18 may receive the DarkSword exploit chain.
Researchers also linked 93 of the identified domains to 21 tracking servers.
How Coruna and DarkSword Infect iPhones
The campaign uses websites that appear to offer ordinary online services. Researchers discovered malicious pages disguised as dating platforms, AI chat services, cryptocurrency promotions, and streaming websites.
Once someone visits one of these pages, hidden scripts can load the exploit without displaying an obvious warning.
Some websites also encourage visitors to open links in Safari. This helps the malicious code run in the browser environment it is designed to target.
The two exploit kits use different techniques:
- Coruna: Uses Safari and WebAssembly-related weaknesses to access browser memory and bypass security protections.
- DarkSword: Uses several stages to move beyond the browser and reach other iOS system processes.
The Coruna chain includes CVE-2022-48503, which involves a WebAssembly-related Safari vulnerability. After gaining access, its components attempt to reach deeper parts of the operating system.
DarkSword follows a different route. It reportedly moves from browser execution through the GPU process and into a system service called mediaplaybackd.
Stolen Data and Hidden Malware Activity
The researchers examined DarkSword on an iPhone running iOS 18.6.2. During testing, the device contacted an attacker-controlled server 144 times and downloaded seven additional modules.
Some of these components were designed to collect information stored on the device.
The investigation found evidence of capabilities involving:
- Reading Telegram’s local application data.
- Collecting the Apple Notes database.
- Gathering information about installed applications.
- Communicating with remote attacker-controlled servers.
The malware also uses techniques to make investigation harder. These include removing certain crash records and Safari browsing data.
Researchers have also identified other ways the exploits are being distributed. SafeDep found Coruna-related malicious code inside a compromised npm package called art-template. Websites using affected package versions could unknowingly serve the malicious code to their visitors.
Another case involved a fake jQuery file hosted on a domain designed to look like Google’s infrastructure.
These findings show that attackers can spread mobile threats through compromised websites and software dependencies, not just suspicious links.
How iPhone Users and Organizations Can Stay Protected
Apple has released security fixes for the vulnerabilities used in these attack chains. Users should install the newest iOS version available for their devices rather than continuing to use older software.
Recommended precautions include:
- Install security updates: Check Settings and update your iPhone to the latest supported iOS release.
- Use Lockdown Mode: People at higher risk, including journalists, activists, and business executives, should consider enabling this protection.
- Avoid suspicious websites: Be careful with unexpected links and requests to open pages in Safari.
- Review mobile devices: Organizations should ensure that company-managed and personal devices used for work receive security updates.
- Monitor suspicious activity: Security teams should investigate unusual crashes, unexpected system behavior, and signs of compromised applications.
- Check website dependencies: Website owners should review third-party scripts and software packages for malicious changes.
The identity of the operators behind these campaigns has not been confirmed. Researchers also caution that code comments or language found in recovered files are not enough to identify the people responsible.
The main concern is that a normal website visit can become an entry point for a serious mobile attack. Keeping devices updated and checking the security of websites and software dependencies are important steps in reducing this risk.
IoCs
| Type | Indicator | Context |
|---|---|---|
| Loader hash/ID | cecd08aa6ff548c2 | Shared Coruna loader identifier |
| Global namespace | globalThis.obChTK | Namespace used by the malicious JavaScript |
| Campaign ID | 1DECX7UIQIB95 | Config on xxtg1[.]eu[.]cc |
| Campaign ID | k7Xp3Rm9Qz | Config on 66wc[.]eu[.]cc |
| Domain | ccsigen321qc[.]com | DarkSword C2 for modules, check-ins, and data theft |
| Domain/URL | vrgrt4t33[.]com/log.html | Exploit telemetry endpoint |
| Domain | ssc[.]vever3eds[.]com | Central staging host for both chains |
| Domain | melatibiru[.]win | Site used to analyze the iOS 18 chain |
| Domain | echomint[.]buzz | AI-companion lure |
| Domain | ax[.]xoovo[.]top | Casino-themed lure with hidden frame |
| Domain | www2[.]disp[.]cc | Forum-style lure with off-screen frames |
| Domain | xxtg1[.]eu[.]cc | Brazilian dating lure |
| Domain | 3x3br[.]eu[.]cc | Lure telling TikTok users to leave the app |
| Domain | 66wc[.]eu[.]cc | Coruna loader site |
| Domain | jiaoyou[.]eu[.]cc | Variant with changed module loading |
| Domain | kjkp[.]com[.]cn | Adult-content site serving a shared runtime |
| Domain | qcsh[.]com[.]cn | Adult-content site serving a shared runtime |
| Domain | toongod[.]us | Compromised comic site |
| Domain | ajax[.]googleapls[.]com | Look-alike Google CDN serving a fake jquery.min.js |
| Domain/URL | a111[.]life/guard.html | Frame that starts the Coruna chain |
| Domain | commoditytrendpilot[.]site | Certificate link to related infrastructure |
| Domain | stocktrendpilot[.]net | Listed on the same certificate |
| IP address | 5[.]255[.]61[.]234 | Linked to several dating lures in passive DNS |
| File | rce_worker_18.6.js | iOS 18.6 exploit worker |
| File | pe_worker_body.js | Post-exploitation module |
| File | c2_agent.js | Command agent |
| File | telegram_v1.js | Telegram data-theft module |
| Path | /private/var/tmp/c2_ipc | Blocked IPC directory creation attempt |
| URI path | /api/payload/get | Module download from C2 |
| URI path | /api/task/pull | Task polling |
| URI path | /beacon | C2 check-in |
| URI path | /static/js/vendor/base.min.html | Path serving the 29,924-byte runtime |
About the Author
