Loading story…
A phishing campaign targeting Italian users impersonates SEND, the official-notification service operated by pagoPA, to collect personal and payment information while attempting to silently compromise iPhones. The malicious pages deliver an exploit chain aimed at Safari/WebKit on iOS 13 through 17.2.1, reportedly combining a WebKit vulnerability, a Pointer Authentication Code (PAC) bypass, and a Safari sandbox escape to obtain native-level access on susceptible devices.
D3Lab reported that the payload could collect browser data, SMS messages, contacts, call history, Safari and Wi-Fi artifacts, photos, health records, and data from messaging and wallet applications; it also supports command-and-control polling and remote JavaScript execution. Parts of the chain resemble material in the public Coruna Pro V2 repository, but no known threat actor has been attributed. Reported infrastructure includes 186.244.241.174 and three domains; the published indicators were automatically extracted and should be independently validated before blocking or detection deployment.
See which actors are running it and whether you're in range.
1 event from the most recent confirmed update back to the earliest known activity.
D3Lab published an analysis of a campaign impersonating Italy's SEND/pagoPA notification service to steal personal and payment data and load an iOS Safari/WebKit exploit chain through a hidden iframe. The reported chain targets iOS 13.0 through 17.2.1, aiming to bypass Pointer Authentication Code protections and escape the Safari sandbox for native-level access; D3Lab did not attribute it to a known threat actor.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 17 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hungary's National Cybersecurity Institute warned that **DarkSword**, a publicly available spyware and exploit kit for Apple devices, is targeting iPhones and iPads running `iOS 18.4` through `18.7` and corresponding `iPadOS` versions. The malware was described as easy to deploy after its code was released on a popular code-sharing platform, lowering the barrier for cyber-espionage activity. Once executed, DarkSword can steal contacts, messages, call history, authentication-related data, and other sensitive information, then exfiltrate it to attacker-controlled servers before deleting itself from the device to hinder detection. New reporting says the operation has since grown into a broad malicious web infrastructure spanning **180 web properties and 27 hosts**, using fake Apple sign-in pages, Apple-themed lures, and compromised websites to deliver a leaked six-vulnerability exploit chain and **GHOSTBLADE** data-theft modules. Researchers said successful compromise can expose keychain contents, iCloud data, Wi-Fi credentials, files, and Apple ID credentials, while operators rotate servers quickly and remove artifacts such as crash reports and `RemoteLog.log` to frustrate forensic analysis. Defenders were urged to apply Apple security updates, enable **Lockdown Mode** where patching is delayed, and monitor for recurring infrastructure fingerprints tied to the campaign.
Aug 4, 2026
Google’s Threat Intelligence Group (GTIG) reported on **Coruna**, a commercial/spy-grade iOS exploit kit that has circulated among multiple threat actors and shifted use cases over time—from a surveillance customer to suspected state-linked watering-hole activity and later to financially motivated abuse. GTIG assessed Coruna includes **five full iOS exploit chains** comprising **23 exploits**, mixing CVE-tracked vulnerabilities with additional flaws that were not assigned CVEs (with CVE mapping potentially subject to revision as analysis continues). The exploit chains target iOS via ordinary web content, leveraging **WebKit memory-corruption** and related browser subsystem weaknesses to achieve capabilities such as **remote code execution** and **sandbox escape**. Reporting highlighted that Coruna’s exploit set largely relies on older issues that are likely patched on current devices, but the kit was assessed as capable (with varying reliability) of targeting iPhone models across a wide range of versions, from **iOS 13.0 through iOS 17.2.1**. Publicly referenced CVEs associated with Coruna include **CVE-2024-23222**, **CVE-2022-48503** (later added to CISA’s KEV), **CVE-2023-43000**, and multiple WebKit/privilege escalation bugs used as zero-days in prior campaigns (e.g., **CVE-2023-38606**, **CVE-2023-32434**, **CVE-2023-32409**). Mandiant/Google also published a set of **URLs observed delivering Coruna** landing pages (e.g., paths like `/group.html` and `/static/analytics.html` across numerous domains), intended to support detection and threat hunting.
Aug 10, 2026
Researchers from **Google**, **iVerify**, and **Lookout** disclosed **DarkSword**, a sophisticated iPhone exploit chain used in compromised websites to silently infect visitors, with observed targeting focused on **Ukraine** and additional activity tied to **Saudi Arabia, Turkey, and Malaysia**. The campaign is linked to suspected Russian operators, including activity tracked as **UNC6353**, and appears to support both **espionage** and **financial theft**, including the theft of saved passwords, text messages, and cryptocurrency wallet data. Reporting also indicates DarkSword is the second major iOS exploit kit recently found in the wild after **Coruna**, reinforcing concerns that advanced mobile exploitation is becoming more broadly operationalized rather than reserved for narrowly targeted, bespoke use. Technical analysis shows DarkSword used multiple chained vulnerabilities to achieve full device compromise on older iOS versions, including JavaScriptCore bugs **`CVE-2025-31277`** and **`CVE-2025-43529`** for remote code execution, **`CVE-2026-20700`** as a `dyld` PAC bypass, and sandbox escapes that pivoted from **WebContent** to the **GPU process** and then to `mediaplaybackd`. The exploit chain relied on first compromising **WebKit** and then abusing **WebGPU/ANGLE**-related paths to escape Safari’s sandbox, and Apple patched the flaws across later iOS releases including **18.6**, **18.7.3**, **26.2**, and **26.3**. Researchers warned that a substantial installed base of devices running **iOS 18 or earlier** remained exposed at the time of disclosure, making DarkSword notable both for its technical sophistication and for the scale of potentially vulnerable iPhones.
Sep 4, 2026