Hackers Use Zero-Click Coruna and DarkSword Exploits to Steal Sensitive Data From iPhones

Hackers are using two powerful iPhone exploit kits, Coruna and DarkSword, to break into phones and steal private data. The victim only has to open a web page. There is no app to install and no prompt to accept.

The scale is larger than many people expected. Researchers found 608 domains delivering Coruna-family code. These sites choose an exploit chain based on the iOS version on the phone.

iPhones on iOS 17.2.1 or older get the original Coruna kit. Newer iPhones on iOS 18 get a chain built from DarkSword. Earlier reporting on the Coruna and DarkSword kits already showed how outdated iPhones are at risk from a single website visit.

Analysts at Zimperium’s zLabs team identified and documented this activity in a detailed technical report published on October 29, 2026.

They recovered both the browser code and the native payloads. They also matched 93 of the domains to 21 tracking servers.

Hackers Use Zero-Click Coruna and DarkSword Exploits

The infection starts with a page that looks normal. Zimperium found dating sites built for users in Brazil, Nigeria, and Indonesia.

It also found AI-companion chat sites, crypto promotions, and streaming pages. While the visitor sees the decoy, a hidden frame loads the exploit in the background.

Some pages tell TikTok users to tap “Open in browser” so the link opens in Safari, which is the browser the exploit needs. Nothing looks wrong on screen, so advice like “watch for strange behavior” does not help here.

Next, a script checks the iOS version and picks the right path. The Coruna chain uses CVE-2022-48503, a WebAssembly flaw in Safari, to read and write browser memory.

It then bypasses pointer authentication, an Apple protection that signs code addresses so tampering is caught. After it escapes the browser, the native modules read and write kernel memory and change code-signing settings.

They talk to their servers over encrypted traffic with certificate checks turned off. They also delete crash logs and Safari website data to cover their tracks.

The DarkSword chain works in steps. Browser code runs first. It then breaks out through the GPU process and moves into mediaplaybackd, a system media service.

In Zimperium’s test on an iPhone running iOS 18.6.2, the phone contacted the command server 144 times and pulled seven extra modules.

One module was built to read Telegram’s local storage. The phone then sent out its Apple Notes database and a list of 214 installed apps.

The same kit has also appeared across DarkSword’s growing web infrastructure that operators replace within days, as DarkSword’s growing web infrastructure reporting from Censys showed.

Supply Chain Delivery and Ways to Stay Safe

Not every infection starts with a bad link. SafeDep found matching Coruna code inside the backdoored art-template npm package that many developers had pulled into their sites.

Any site using the bad versions served the exploit to its own visitors, so no suspicious lure domain was needed. Domain blocklists miss this route completely.

Zimperium also spotted a fake jquery.min.js file loaded from a look-alike Google domain on a comic site, which then started the Coruna chain.

Who is behind it remains unclear. Coruna was first built by a nation-state actor for targeted work, but its leak spread the toolkit to many groups.

Some recovered code has Chinese-language comments. Zimperium says that only describes how the code was written, not who deployed it, so it ties its conclusions to the code and infrastructure only.

The best defense is patching, because every CVE in these chains is already fixed. Apple even pushed an expanded iOS 18.7.7 update to more devices to block DarkSword, so users should check Settings for the newest version offered for their phone.

People at higher risk, such as journalists, activists, and executives, should turn on Lockdown Mode. Everyone should treat unexpected “Open in Safari” prompts as a stop sign.

Security teams should require patched iOS builds on all devices, including personal ones used for work. Mobile threat defense tools can flag odd crashes, unexpected restarts, and disabled code signing.

Teams should also keep diagnostic logs for high-risk users, because the malware deletes local traces. Site owners should audit third-party scripts and enforce a strict Content Security Policy.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Use Zero-Click Coruna and DarkSword Exploits to Steal Sensitive Data From iPhones appeared first on Cyber Security News.