Coruna and DarkSword iPhone Exploit Campaigns Span 608 Domains

Zimperium’s zLabs identified 608 domains delivering Coruna-family exploit code, including a DarkSword-derived chain targeting newer iOS versions. Attackers use deceptive websites, hidden iframes, compromised legitimate sites, and a backdoored npm package to expose iPhones to browser exploits, with delivery scripts selecting chains based on the device’s iOS version. Compromise requires no app installation or permission prompt, although victims must encounter the malicious web content. Attribution remains unresolved; shared code identifies the frameworks, but Chinese-language comments do not establish an operator or country.

In testing on iOS 18.6.2, the DarkSword-derived chain downloaded seven additional modules, pivoted through system processes, and exfiltrated an Apple Notes database and an inventory of 214 installed applications. Recovered Coruna modules support kernel-memory access, code-signing manipulation, process-memory access, encrypted communications, and forensic-artifact deletion. All mapped vulnerabilities have already been patched, making current iOS updates the primary mitigation. Organizations should prioritize updates across managed iPhones, consider Lockdown Mode for high-risk users, and strengthen controls over third-party website scripts and dependencies.