Security researchers have observed attackers deploying the Coruna and DarkSword iOS exploit kits together from a single malicious website. The combined setup, called DarkCoruna, expands the range of vulnerable iPhone versions an attacker can compromise from one visit.
Coruna and DarkSword are full-chain iOS exploit kits. Each begins with a user visiting a compromised or fake website, then uses browser, sandbox-escape, and kernel vulnerabilities to gain deep access to the device.
Coruna targets iOS 13 through 17.2.1 using 23 vulnerabilities across five exploit chains, while DarkSword targets iOS 18.4 through 18.7 using six vulnerabilities. By pairing them, attackers can cover a much broader population of unpatched iPhones.
DarkSword can collect Wi-Fi passwords, messages, call records, location history, browser data, and cryptocurrency wallet files. Coruna adds wallet-focused harvesting capabilities, including searches for crypto recovery phrases and wallet data.
DarkCoruna iOS Exploit Fusion
Both kits originally appeared in surveillance and state-linked operations. Researchers have linked Coruna to watering-hole attacks against Ukrainian users, while DarkSword activity has also been reported in Saudi Arabia, Turkey, and Malaysia.
The threat has since spread to financially motivated criminals. iVerify reported that Coruna attacks affected 5% of devices running vulnerable iOS versions in September 2026, up from 1.5% in August.
DarkSword’s source code was leaked after its disclosure, enabling new variants and wider reuse. Researchers have also found exposed infrastructure containing exploit stages, command servers, and wallet-theft modules tied to the DarkSword/Coruna ecosystem.
Patching remains the first defense. Apple has addressed the vulnerabilities used by both kits, but organizations should ensure all managed and unmanaged iPhones receive updates quickly.
Apple’s Lockdown Mode can disrupt parts of these attack chains, and Coruna is designed to withdraw when it detects the feature. However, it must be enabled before a user visits the malicious page, and its restrictions can interfere with normal work and device management.
Mobile security architect Akili Akridge recommends fleet-wide visibility, identity-scoped access, MDM and mobile application management as a baseline, and a loaner-device bench for incident response.
When compromise is suspected, teams should isolate the device, preserve it for forensics, and issue a clean replacement.
Because these attacks operate close to the kernel and can remove traces of activity, traditional app-layer or network-only defenses may miss them.
Security teams should consider mobile EDR tools that collect low-level device telemetry and monitor identity activity alongside device behavior, iverify said.
Organizations should treat any compromised work device as exposing every credential stored on it. Executives, global administrators, and the CISO deserve priority protection because of their elevated access.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
