Coruna and DarkSword Exploit Kits Fully Compromise iPhones via Web Visit

Key Takeaways

• Two sophisticated exploit kits, Coruna and DarkSword, can fully compromise iPhones simply by a user visiting a malicious or compromised website.
• These kits leverage multiple vulnerabilities to escape browser sandboxes and gain deep system access, potentially stealing sensitive data like passwords, messages, and cryptocurrency wallet information.
• Coruna targets iOS versions 13.0 through 17.2.1, while DarkSword is effective against iOS 18.4 through 18.7.
• Initial attribution of Coruna pointed to surveillance customers and espionage, but both kits have since been adopted by financially motivated cybercriminals after their code became publicly available.
• Staying updated with the latest iOS versions is the primary defense, as these updates patch the underlying vulnerabilities exploited by these kits.

Two potent exploit kits, Coruna and DarkSword, demonstrate the severe risk that visiting a malicious or compromised website poses to iPhones running outdated software. These kits are engineered to chain together multiple software vulnerabilities, enabling them to bypass browser security measures and penetrate deeper into the iOS operating system.

Depending on the specific iOS version and the exploit kit employed, attackers can surreptitiously exfiltrate sensitive user data without requiring any user interaction beyond the initial web visit, such as installing an application or responding to prompts. This capability highlights a critical threat vector for unpatched Apple devices.

Exploit kits are not merely malicious webpages; they are sophisticated frameworks designed to identify a visitor’s device and its software configuration, then deploy tailored exploit code. This precision targeting significantly increases their efficacy against vulnerable systems.

Coruna incorporates five complete exploit chains and a total of 23 exploits, specifically designed to target iOS versions 13.0 up to 17.2.1. In contrast, DarkSword utilizes a six-flaw chain that impacts iOS versions 18.4 through 18.7. The distinct range of iOS versions targeted by each kit means the risk profile for a device is directly tied to its installed operating system version.

Researchers from iVerify identified and analyzed DarkSword in collaboration with Google and Lookout. iVerify has also documented newer variants of these threats observed in active campaigns. A detailed investigation published in October 2026 by iVerify’s researchers revealed a modified version, dubbed P7 DarkSword, capable of extracting keychain data and cryptocurrency wallet information. More details can be found in iVerify’s DarkSword variant threat research.

Coruna and DarkSword Exploit Kits in Detail

The attack sequence initiates when an iPhone’s Safari browser renders a malicious web page or embedded content within an otherwise legitimate, but compromised, website. The page first profiles the iPhone’s model and its iOS version. Subsequently, it delivers exploit code specifically crafted for that device’s configuration.

Initially, a vulnerability within WebKit or JavaScriptCore allows the malicious code to execute within the browser environment. Further vulnerabilities are then leveraged to bypass the browser’s inherent security boundaries, known as the sandbox, thereby escalating privileges to gain higher system access. This multi-stage approach is crucial because the browser typically operates within a restricted sandbox designed to limit a webpage’s interactions with the underlying operating system and sensitive data.

Coruna and DarkSword exploit additional flaws to circumvent these sandbox restrictions. The advanced stages of these exploit chains can achieve kernel-level access, granting attackers extensive control over the compromised device. Early research into Coruna’s exploits provides further insights into the range of vulnerabilities and iOS versions it targets, as detailed in this report on Coruna and DarkSword.

Once compromised, the kits are capable of extracting a wide array of valuable data. Reports on DarkSword highlight the theft of passwords, private messages, web browsing history, location data, and the contents of cryptocurrency wallets. iVerify’s analysis of the P7 variant further indicates on-device keychain collection and bidirectional communication with the attacker’s command-and-control server. Such a compromise poses significant risks to both personal accounts and corporate access, particularly if the device stores saved credentials or is used for multi-factor authentication approvals.

From Targeted Tools to Wider Criminal Use

The operational history of Coruna illustrates a common trajectory for sophisticated exploits: from targeted use by surveillance entities to broader criminal exploitation. Google initially tracked Coruna’s deployment by a surveillance client, followed by espionage activities against Ukrainian users, and later its integration into financially motivated campaigns utilizing deceptive finance and cryptocurrency websites. The ultimate payload delivered by Coruna, known as PlasmaLoader, is specifically engineered to target cryptocurrency wallets and to scan Apple Notes for recovery phrases.

DarkSword similarly transitioned from limited, specialized use to wider adoption after its source code was publicly leaked in 2026. This leak significantly lowered the barrier for other threat actors to acquire and adapt the kit. Subsequent reporting has documented instances where attackers have combined DarkSword’s initial device access capabilities with Coruna’s wallet-theft functionalities. This convergence of capabilities is discussed in a comprehensive platform report on DarkSword and Coruna.

While a public leak does not guarantee universal functionality across all iPhone models, it undeniably facilitates the reuse and modification of exploit code. Detecting these threats can be challenging; some implants operate within legitimate system processes and may erase their operational traces upon completion. Standard browser or network monitoring tools may also fail to detect post-exploitation activities once the malicious code has gained control of the device. However, iVerify reported that certain DarkSword variants leave discernible forensic artifacts, including Safari browsing history and crash logs. Coruna artifacts, conversely, may persist even after a device reboot or an iOS update, as detailed in the DarkSword variant threat research and the Coruna and DarkSword exploit kits report.

What You Should Do

• Update iOS Immediately: The most crucial mitigation is to install the latest available iOS updates for your device. These updates contain patches for the vulnerabilities exploited by Coruna and DarkSword. Check “Settings” > “General” > “Software Update” and install any available version.
• Enable Lockdown Mode: For individuals at elevated risk of targeted attacks, enabling Lockdown Mode can provide an additional layer of protection, especially before visiting potentially untrusted websites. However, it is not a substitute for regular software updates.
• Exercise Caution with Financial Sites: Be extremely wary of unexpected finance or cryptocurrency websites, even if they appear legitimate. Always verify URLs and consider navigating directly to known, trusted sites rather than clicking links.
• For Organizations:
  • Maintain a strict policy for tracking and updating iOS versions across all corporate-issued devices.
  • Regularly review the scope of access and accounts accessible from each mobile device.
  • Develop an incident response plan for isolating and investigating devices suspected of compromise.
  • If a device is suspected of compromise, immediately treat all credentials stored on it as compromised. Change passwords from a trusted, uninfected device, revoke active sessions, and promptly engage your organization’s security team. Consider providing a temporary loaner device to staff while the original device undergoes forensic analysis.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.