Key points
- Coruna targets iOS 13.0 through 17.2.1 using five exploit chains containing 23 distinct flaws.
- DarkSword targets iOS 18.4 through 18.6.2 with a chain designed to reach kernel-level access.
- Combined deployments dubbed DarkCoruna allow attackers to target a wider range of iOS versions.
Attackers using the Coruna and DarkSword exploit kits can seize control of vulnerable iPhones after a user visits a single malicious or compromised website. This access allows them to bypass standard browser protections and harvest sensitive data, including keychain entries, Wi-Fi passwords, messages, and cryptocurrency wallet files. The threat is significant because it requires no user interaction beyond loading the page, meaning even cautious users can be compromised if their device software is outdated.
In plain English
An exploit kit is a collection of tools that checks a visitor’s device and serves code designed for its specific software version. Coruna and DarkSword use these tools to break out of the browser’s restricted environment, known as the sandbox. Once outside the sandbox, the kits can reach deeper parts of the operating system, including privileged processes and the kernel. This gives the attacker broad control over the device, allowing them to run implants in memory and collect data without the user installing any apps or approving extra prompts.
The background
Google’s Threat Intelligence Group documented Coruna’s five exploit chains, which target iOS versions from 13.0 to 17.2.1. iVerify, in collaboration with Lookout and Google, analysed DarkSword, which uses a chain aimed at iOS 18.4 through 18.6.2. Researchers later reported that attackers were combining these kits into a single deployment called DarkCoruna to target a wider range of iOS versions from one website visit. This merging allows attackers to use surveillance-grade capabilities for financially motivated campaigns, often using fake finance or cryptocurrency websites as entry points.
What changes now
The history of Coruna illustrates how powerful exploit tools change hands. Google tracked its use from a surveillance-vendor customer to a suspected Russian espionage operation targeting Ukrainian users, and later to financially motivated campaigns. iVerify’s September 2026 telemetry found live and historic Coruna attacks affecting 5% of devices it measured, up from 1.5% in August. For organisations, a compromised phone may expose both personal information and credentials used to reach corporate services, highlighting the risk when device software status is unknown.
The attacker's path
Teams usually monitor for unusual browser behaviour or unexpected privilege escalation attempts, which often signal an exploit chain in progress. Check whether endpoint detection tools are configured to alert on processes moving from web content handlers to system-level services. Verify that network traffic analysis covers encrypted connections that might exfiltrate stolen credentials. Ensure that incident response plans address scenarios where the initial infection vector is a single web visit rather than a downloaded file, allowing for faster containment of memory-resident implants.
Background: Incident response plans
Effective incident response relies on pre-defined roles, offline communication channels, and validated data backups. You must test your plan regularly to ensure it functions under stress, rather than relying on theoretical procedures that ignore real-world chaos.
Read the full guide: Incident Response Plans: Best Practices for Resilient Recovery
What to do and how to stay safe: Coruna
- Verify that all managed iOS devices are running the latest available software updates to close known vulnerabilities.
- Monitor network traffic for unusual data exfiltration patterns that may indicate credential theft or implant communication.
- Educate users to avoid clicking on links in unsolicited messages, particularly those leading to finance or cryptocurrency sites.
- Review access logs for corporate services to detect unauthorised sign-ins from mobile devices that may have been compromised.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which iOS versions are affected by Coruna and DarkSword?
Coruna targets iOS 13.0 through 17.2.1, while DarkSword targets iOS 18.4 through 18.6.2. Combined deployments aim to cover a wider range.
What data can these exploit kits steal?
They can collect keychain data, Wi-Fi passwords, messages, location history, browsing records, and files associated with cryptocurrency wallets.
How do these attacks start?
The attack begins when a user opens a compromised legitimate site or a fake finance page, allowing the kit to serve tailored exploit code.
