Apple will release backported security patches for iOS 18 users to address vulnerabilities exploited by the DarkSword hacking tool. These patches are described as rare and aim to protect devices from potential attacks. The updates will be pushed out to mitigate risks associated with the tool. The post references an article from *Wired* for further details.

Hackers are using two powerful iPhone exploit kits, Coruna and DarkSword, to break into phones and steal private data. The victim only has to open a web page. There is no app to install and no prompt to accept. The scale is larger than many people expected. Researchers found 608 domains delivering Coruna-family code. These sites choose an exploit chain based on the iOS version on the phone. iPhones on iOS 17.2.1 or older get the original Coruna kit. Newer iPhones on iOS 18 get a chain built from DarkSword. Earlier reporting on the Coruna and DarkSword kits already showed how outdated iPhones are at risk from a single website visit. Analysts at Zimperium’s zLabs team identified and documented this activity in a detailed technical report published on October 29, 2026. They recovered both the browser code and the native payloads. They also matched 93 of the domains to 21 tracking servers. Hackers Use Zero-Click Coruna and DarkSword Exploits The infection starts with a page that looks normal. Zimperium found dating sites built for users in Brazil, Nigeria, and Indonesia. It also found AI-companion chat sites, crypto promotions, and streaming pages. While the visitor sees the decoy, a hidden frame loads the exploit in the background. Some pages tell TikTok users to tap “Open in browser” so the link opens in Safari, which is the browser the exploit needs. Nothing looks wrong on screen, so advice like “watch for strange behavior” does not help here. AI-companion chat and legitimate casino content (Source – Zimperium) Next, a script checks the iOS version and picks the right path. The Coruna chain uses CVE-2022-48503, a WebAssembly flaw in Safari, to read and write browser memory. It then bypasses pointer authentication, an Apple protection that signs code addresses so tampering is caught. After it escapes the browser, the native modules read and write kernel memory and change code-signing settings. They talk to their servers over encrypted traffic with certificate checks turned off. They also delete crash logs and Safari website data to cover their tracks. The DarkSword chain works in steps. Browser code runs first. It then breaks out through the GPU process and moves into mediaplaybackd, a system media service. In Zimperium’s test on an iPhone running iOS 18.6.2, the phone contacted the command server 144 times and pulled seven extra modules. One module was built to read Telegram’s local storage. The phone then sent out its Apple Notes database and a list of 214 installed apps. The same kit has also appeared across DarkSword’s growing web infrastructure that operators replace within days, as DarkSword’s growing web infrastructure reporting from Censys showed. Supply Chain Delivery and Ways to Stay Safe Not every infection starts with a bad link. SafeDep found matching Coruna code inside the backdoored art-template npm package that many developers had pulled into their sites. Any site using the bad versions served the exploit to its own visitors, so no suspicious lure domain was needed. Domain blocklists miss this route completely. Zimperium also spotted a fake jquery.min.js file loaded from a look-alike Google domain on a comic site, which then started the Coruna chain. Who is behind it remains unclear. Coruna was first built by a nation-state actor for targeted work, but its leak spread the toolkit to many groups. Delivery and tracking in the recovered infrastructure (Source – Zimperium) Some recovered code has Chinese-language comments. Zimperium says that only describes how the code was written, not who deployed it, so it ties its conclusions to the code and infrastructure only. The best defense is patching, because every CVE in these chains is already fixed. Apple even pushed an expanded iOS 18.7.7 update to more devices to block DarkSword, so users should check Settings for the newest version offered for their phone. People at higher risk, such as journalists, activists, and executives, should turn on Lockdown Mode. Everyone should treat unexpected “Open in Safari” prompts as a stop sign. Security teams should require patched iOS builds on all devices, including personal ones used for work. Mobile threat defense tools can flag odd crashes, unexpected restarts, and disabled code signing. Teams should also keep diagnostic logs for high-risk users, because the malware deletes local traces. Site owners should audit third-party scripts and enforce a strict Content Security Policy. Indicators of compromise (IoCs):- Type Indicator Context Loader hash/ID cecd08aa6ff548c2 Shared Coruna loader identifier Global namespace globalThis.obChTK Namespace used by the malicious JavaScript Campaign ID 1DECX7UIQIB95 Config on xxtg1[.]eu[.]cc Campaign ID k7Xp3Rm9Qz Config on 66wc[.]eu[.]cc Domain ccsigen321qc[.]com DarkSword C2 for modules, check-ins, and data theft Domain/URL vrgrt4t33[.]com/log.html Exploit telemetry endpoint Domain ssc[.]vever3eds[.]com Central staging host for both chains Domain melatibiru[.]win Site used to analyze the iOS 18 chain Domain echomint[.]buzz AI-companion lure Domain ax[.]xoovo[.]top Casino-themed lure with hidden frame Domain www2[.]disp[.]cc Forum-style lure with off-screen frames Domain xxtg1[.]eu[.]cc Brazilian dating lure Domain 3x3br[.]eu[.]cc Lure telling TikTok users to leave the app Domain 66wc[.]eu[.]cc Coruna loader site Domain jiaoyou[.]eu[.]cc Variant with changed module loading Domain kjkp[.]com[.]cn Adult-content site serving a shared runtime Domain qcsh[.]com[.]cn Adult-content site serving a shared runtime Domain toongod[.]us Compromised comic site Domain ajax[.]googleapls[.]com Look-alike Google CDN serving a fake jquery.min.js Domain/URL a111[.]life/guard.html Frame that starts the Coruna chain Domain commoditytrendpilot[.]site Certificate link to related infrastructure Domain stocktrendpilot[.]net Listed on the same certificate IP address 5[.]255[.]61[.]234 Linked to several dating lures in passive DNS File rce_worker_18.6.js iOS 18.6 exploit worker File pe_worker_body.js Post-exploitation module File c2_agent.js Command agent File telegram_v1.js Telegram data-theft module Path /private/var/tmp/c2_ipc Blocked IPC directory creation attempt URI path /api/payload/get Module download from C2 URI path /api/task/pull Task polling URI path /beacon C2 check-in URI path /static/js/vendor/base.min.html Path serving the 29,924-byte runtime Note:   IP addresses and domains are intentionally defanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs . The post Hackers Use Zero-Click Coruna and DarkSword Exploits to Steal Sensitive Data From iPhones appeared first on Cyber Security News .

Zimperium’s zLabs analyzed Coruna and DarkSword iOS exploit chains, documenting hidden-frame delivery, version-specific exploits, native capabilities and…

Hackers are using two powerful iPhone exploit kits, Coruna and DarkSword, to break into phones and steal private data. The victim only has to open a web page. There is no app to install and no prompt to accept. The scale is larger than many people expected. Researchers found 608 domains delivering Coruna-family code. These sites choose an exploit chain based on the iOS version on the phone. iPhones on iOS 17.2.1 or older get the original Coruna kit. Newer iPhones on iOS 18 get a chain built from DarkSword. Earlier reporting on the Coruna and DarkSword kits already showed how outdated iPhones are at risk from a single website visit. Analysts at Zimperium’s zLabs team identified and documented this activity in a detailed technical report published on October 29, 2026. They recovered both the browser code and the native payloads. They also matched 93 of the domains to 21 tracking servers. Hackers Use Zero-Click Coruna and DarkSword Exploits The infection starts with a page that looks normal. Zimperium found dating sites built for users in Brazil, Nigeria, and Indonesia. It also found AI-companion chat sites, crypto promotions, and streaming pages. While the visitor sees the decoy, a hidden frame loads the exploit in the background. Some pages tell TikTok users to tap “Open in browser” so the link opens in Safari, which is the browser the exploit needs. Nothing looks wrong on screen, so advice like “watch for strange behavior” does not help here. AI-companion chat and legitimate casino content (Source – Zimperium) Next, a script checks the iOS version and picks the right path. The Coruna chain uses CVE-2022-48503, a WebAssembly flaw in Safari, to read and write browser memory. It then bypasses pointer authentication, an Apple protection that signs code addresses so tampering is caught. After it escapes the browser, the native modules read and write kernel memory and change code-signing settings. They talk to their servers over encrypted traffic with certificate checks turned off. They also delete crash logs and Safari website data to cover their tracks. The DarkSword chain works in steps. Browser code runs first. It then breaks out through the GPU process and moves into mediaplaybackd, a system media service. In Zimperium’s test on an iPhone running iOS 18.6.2, the phone contacted the command server 144 times and pulled seven extra modules. One module was built to read Telegram’s local storage. The phone then sent out its Apple Notes database and a list of 214 installed apps. The same kit has also appeared across DarkSword’s growing web infrastructure that operators replace within days, as DarkSword’s growing web infrastructure reporting from Censys showed. Supply Chain Delivery and Ways to Stay Safe Not every infection starts with a bad link. SafeDep found matching Coruna code inside the backdoored art-template npm package that many developers had pulled into their sites. Any site using the bad versions served the exploit to its own visitors, so no suspicious lure domain was needed. Domain blocklists miss this route completely. Zimperium also spotted a fake jquery.min.js file loaded from a look-alike Google domain on a comic site, which then started the Coruna chain. Who is behind it remains unclear. Coruna was first built by a nation-state actor for targeted work, but its leak spread the toolkit to many groups. Delivery and tracking in the recovered infrastructure (Source – Zimperium) Some recovered code has Chinese-language comments. Zimperium says that only describes how the code was written, not who deployed it, so it ties its conclusions to the code and infrastructure only. The best defense is patching, because every CVE in these chains is already fixed. Apple even pushed an expanded iOS 18.7.7 update to more devices to block DarkSword, so users should check Settings for the newest version offered for their phone. People at higher risk, such as journalists, activists, and executives, should turn on Lockdown Mode. Everyone should treat unexpected “Open in Safari” prompts as a stop sign. Security teams should require patched iOS builds on all devices, including personal ones used for work. Mobile threat defense tools can flag odd crashes, unexpected restarts, and disabled code signing. Teams should also keep diagnostic logs for high-risk users, because the malware deletes local traces. Site owners should audit third-party scripts and enforce a strict Content Security Policy. Indicators of compromise (IoCs):- Type Indicator Context Loader hash/ID cecd08aa6ff548c2 Shared Coruna loader identifier Global namespace globalThis.obChTK Namespace used by the malicious JavaScript Campaign ID 1DECX7UIQIB95 Config on xxtg1[.]eu[.]cc Campaign ID k7Xp3Rm9Qz Config on 66wc[.]eu[.]cc Domain ccsigen321qc[.]com DarkSword C2 for modules, check-ins, and data theft Domain/URL vrgrt4t33[.]com/log.html Exploit telemetry endpoint Domain ssc[.]vever3eds[.]com Central staging host for both chains Domain melatibiru[.]win Site used to analyze the iOS 18 chain Domain echomint[.]buzz AI-companion lure Domain ax[.]xoovo[.]top Casino-themed lure with hidden frame Domain www2[.]disp[.]cc Forum-style lure with off-screen frames Domain xxtg1[.]eu[.]cc Brazilian dating lure Domain 3x3br[.]eu[.]cc Lure telling TikTok users to leave the app Domain 66wc[.]eu[.]cc Coruna loader site Domain jiaoyou[.]eu[.]cc Variant with changed module loading Domain kjkp[.]com[.]cn Adult-content site serving a shared runtime Domain qcsh[.]com[.]cn Adult-content site serving a shared runtime Domain toongod[.]us Compromised comic site Domain ajax[.]googleapls[.]com Look-alike Google CDN serving a fake jquery.min.js Domain/URL a111[.]life/guard.html Frame that starts the Coruna chain Domain commoditytrendpilot[.]site Certificate link to related infrastructure Domain stocktrendpilot[.]net Listed on the same certificate IP address 5[.]255[.]61[.]234 Linked to several dating lures in passive DNS File rce_worker_18.6.js iOS 18.6 exploit worker File pe_worker_body.js Post-exploitation module File c2_agent.js Command agent File telegram_v1.js Telegram data-theft module Path /private/var/tmp/c2_ipc Blocked IPC directory creation attempt URI path /api/payload/get Module download from C2 URI path /api/task/pull Task polling URI path /beacon C2 check-in URI path /static/js/vendor/base.min.html Path serving the 29,924-byte runtime Note:   IP addresses and domains are intentionally defanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs . The post Hackers Use Zero-Click Coruna and DarkSword Exploits to Steal Sensitive Data From iPhones appeared first on Cyber Security News .

A widespread iPhone cyberattack campaign is using sophisticated Coruna and DarkSword exploit chains to compromise vulnerable Apple devices through ordinary website visits, raising concerns about the security of mobile browsing and the growing abuse of legitimate web infrastructure. Security researchers at Zimperium's zLabs identified 608 domains delivering Coruna-family malicious code through October 2026. Configurations recovered from 93 websites pointed to 21 different tracking collectors, revealing an extensive distribution network designed to deliver exploits and collect information from compromised devices.

Introduction: iOS Security Faces Another Serious Reality Check Apple's security ecosystem continues to face sophisticated exploitation techniques capable of turning seemingly ordinary web interactions into opportunities for surveillance and data theft. New research from Zimperium's zLabs examines two significant iOS exploit chains, Coruna and DarkSword, revealing how attackers can combine hidden-frame delivery, version-specific vulnerabilities and native system capabilities to compromise targeted devices.

iPhoneを狙うDarkSwordに新変種「P7」が登場。悪質広告からの感染、キーチェーンや仮想通貨ウォレットの情報窃取、iOSの対象バージョンを一次情報で確認。最新OSへの更新方法、資産の安全な移動、感染が疑われる場合の対処まで個人向けに解説

https://www.gizmodo.jp/article/2610-ios-security-update-darksword/?utm_source=twitter&utm_medium=feed

Combined research between Report URI and iVerify has uncovered an extensive ecosystem being used to deliver two of the most capable iOS exploit kits ever seen, Coruna and DarkSword. Over the last month, our respective security teams have been tracking this proliferation, Report URI from the web d…

Combined research between Report URI and iVerify has uncovered an extensive ecosystem being used to deliver two of the most capable iOS exploit kits ever seen, Coruna and DarkSword. Over the last month, our respective security teams have been tracking this proliferation, Report URI from the web delivery side and

【更新】iPhoneの攻撃ツール「DarkSword」に新変種P7　仮想通貨ウォレットや保存パスワードを狙う、個人が取るべき対策 https://t.co/xIuCMmLq4F #セキュリティ対策Lab #security #securitynews #セキュリティ #セキュリティニュース

DarkSword kann iPhone-Zugangsdaten abgreifen; Banken raten zu iOS-Updates, während Forscher Infektionen über manipulierte Webseiten dokumentieren.

サイバー犯罪グループが、悪意あるInstagram広告、放置されたアナリティクスタグ、侵害されたWebサイトを使い、脆弱なiPhoneにエクスプロイトキット「Coruna」と「DarkSword」を配信していることがわかりました。 今回の調査から、攻撃者が広告インフラを悪用し、ユーザーが普段どおりWebを閲覧している

iPhoneを狙うDarkSwordに新変種「P7」が登場。悪質広告からの感染、キーチェーンや仮想通貨ウォレットの情報窃取、iOSの対象バージョンを一次情報で確認。最新OSへの更新方法、資産の安全な移動、感染が疑われる場合の対処まで個人向けに解説