Coruna and DarkSword exploit kits compromise iPhones via single web visit
Researchers warn that sophisticated exploit chains can seize control of vulnerable iPhones through a single click on a malicious or compromised website.
Key points
- Coruna targets iOS 13.0 through 17.2.1, while DarkSword aims at iOS 18.4 through 18.6.2.
- Attackers are combining both kits into a "DarkCoruna" deployment to broaden their reach.
- Exploits break browser sandboxes to access keychain data, messages, and cryptocurrency wallets.
Mobile security researchers have identified two sophisticated exploit kits, Coruna and DarkSword, that can fully compromise iPhones through a single visit to a malicious or compromised website. According to analysis by iVerify, Google, and Lookout, these tools allow attackers to seize control of vulnerable devices without requiring users to install additional applications or interact with multiple prompts.
The exploit kits function by chaining multiple software vulnerabilities together to escape the browser’s restricted sandbox environment. Once outside the sandbox, the code progresses through system processes to achieve kernel-level access. This deep system access enables the installation of memory-based implants designed to collect sensitive data, including keychain entries, Wi-Fi passwords, messages, location history, and cryptocurrency wallet files.
Exploit Kit Mechanics and History
Coruna and DarkSword target different ranges of iOS versions, meaning the risk depends heavily on the specific software installed on a device. Google’s Threat Intelligence Group documented five distinct exploit chains within Coruna, comprising 23 individual exploits that target iOS versions 13.0 through 17.2.1. In contrast, iVerify’s analysis of DarkSword revealed a one-click chain aimed at newer devices running iOS 18.4 through 18.6.2.
The provenance of these tools highlights the fluid nature of high-end cybercrime tools. Google tracked Coruna’s usage from an initial surveillance-vendor customer to a suspected Russian espionage operation targeting Ukrainian users. Later, the kit appeared in financially motivated campaigns utilizing fake finance websites. DarkSword was disclosed through a collaboration between iVerify, Lookout, and Google, with its source code subsequently appearing in public repositories.
Impact and Device Exposure
The combination of these tools has led to hybrid deployments. Researchers reported that attackers are merging DarkSword and Coruna into a single deployment dubbed DarkCoruna. This combined kit allows adversaries to target a wider spectrum of iOS versions from a single website visit, increasing the potential attack surface for users on both older and newer devices.
Telemetry from iVerify indicates a rising threat level. Data from September 2026 showed that live and historic Coruna attacks affected 5% of the devices measured, an increase from 1.5% in August. For organizations, a compromised phone poses dual risks: exposure of personal information and the loss of credentials used to access corporate services, particularly when devices are used for authentication approvals.
What should you do?
Enterprises and individual users should prioritize keeping iOS software updated to the latest available version, as updates address the specific vulnerabilities exploited by these chains. However, maintaining current software is not a complete solution if a device’s compromise status is unknown. Security teams should monitor for indicators of kernel-level access and unexpected data exfiltration, such as unusual keychain access patterns or cryptocurrency wallet activity.
Background: Threat intelligence program
A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.
Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats
What to do and how to stay safe: Coruna
- Verify that all iOS devices are running the latest security patches provided by the vendor.
- Monitor network traffic for signs of communication with known command-and-control servers associated with exploit kits.
- Inspect device logs for unauthorized access to system processes or kernel-level activities.
- Review keychain and credential storage for anomalies that may indicate data theft.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which iOS versions are targeted by Coruna and DarkSword?
Coruna targets iOS 13.0 through 17.2.1, while DarkSword targets iOS 18.4 through 18.6.2.
Can these exploits infect a device without user interaction?
Yes, a single visit to a compromised or deceptive website can trigger the exploit chain.
What data can these exploit kits steal?
They can collect keychain data, Wi-Fi passwords, messages, location history, and cryptocurrency wallet files.
