Recent analyses reveal that cybercriminals are leveraging two potent exploit kits, Coruna and DarkSword, to infiltrate iPhones and extract sensitive information. Users are at risk simply by visiting certain web pages, with no need to install apps or accept permissions.
Widespread Impact of Exploit Kits
Researchers have identified a significant expansion in the use of these exploits, with 608 domains actively distributing Coruna-related code. The exploit kits tailor their approach based on the iOS version detected on the device. Devices running iOS 17.2.1 or older encounter the original Coruna kit, while those on iOS 18 face the newer DarkSword chain.
According to a detailed technical report from Zimperium’s zLabs, this threat was documented on October 29, 2026. The researchers managed to recover both the browser-based code and the native payloads, connecting 93 domains to 21 tracking servers.
Mechanics of the Exploits
The exploitation process begins on seemingly harmless web pages. Zimperium identified multiple decoy sites, such as dating platforms and crypto promotions, targeting users in Brazil, Nigeria, and Indonesia. These pages secretly load malicious frames in the background.
In some instances, visitors are prompted to open links in Safari, which the exploit requires. The Coruna exploit chain utilizes a WebAssembly flaw in Safari to manipulate browser memory and circumvent Apple’s security measures, subsequently altering kernel memory and communication settings.
Security Measures and Recommendations
To combat these threats, affected users should ensure their devices are updated with the latest iOS patches, as all vulnerabilities exploited by these kits have been addressed by Apple. Activating Lockdown Mode is advised for high-risk individuals such as journalists and executives.
Organizations are encouraged to enforce device patching policies and deploy mobile threat defense solutions to detect unusual activity. Additionally, website owners should audit third-party scripts to prevent exploitation routes.
Conclusion
The ongoing development and deployment of exploit kits like Coruna and DarkSword underline the critical need for robust cybersecurity measures. Staying informed and proactive in applying security updates remains the most effective defense against such sophisticated threats.
