New research reveals two highly sophisticated exploit kits—Coruna and DarkSword—that can take over iPhones simply by visiting a malicious or compromised website. These chains exploit several flaws together, enabling full system compromise without any need for a user to install an app or click extra prompts. Outdated iOS versions are especially vulnerable, though the exact risk depends on which version your device is running.
What They Are & How They Work
Exploit kits are frameworks that scan a device for its software version and hardware makeup, then serve tailored attack code. Coruna includes five complete exploit chains and 23 individual exploits targeting iOS 13.0 through 17.2.1. DarkSword, by contrast, uses a six-flaw chain aimed at iOS versions 18.4 through 18.7. Each chain combines flaws in WebKit or JavaScriptCore, then escapes the browser sandbox to reach deeper system components like the kernel, gaining near total control.
Once control is established, the kits can harvest a wide range of sensitive data. These include passwords, messages, browsing history, location data, and crypto wallet contents. A newer variant of DarkSword, dubbed P7 DarkSword, has been observed stealing items stored in the on-device keychain.
From Espionage to Broad Criminal Use
Originally, Coruna was used in high-stakes surveillance campaigns, including targeting Ukrainian users. Over time, its reach expanded into financially motivated attacks, often involving impostor finance or crypto sites. Its payload, PlasmaLoader, is designed to harvest credentials and recovery phrases from wallets and Apple Notes.
DarkSword’s capabilities multiplied after its source code leaked in 2026, making it easier for new threat actors to adopt or adapt it. Researchers have seen attackers combining DarkSword’s infection path with Coruna’s wallet-theft tools, creating hybrid attacks. The existence of malware artifacts in system logs, history, or even surviving certain updates makes detection harder.
What Users and Organizations Should Do
The most critical defense is keeping iPhones fully updated. Apple has issued patches for both newer and older models addressing known vulnerabilities used by these exploit kits. Check the Software Update setting for your latest compatible version.
For those at higher risk—such as journalists, activists, and high-profile individuals—Lockdown Mode adds extra protection, though it’s not a full shield and works best when enabled before exposure to malicious content.
Organizations need to track which iOS versions their devices are running, limit account access from high-risk devices, and have protocols to isolate a compromised phone. If you suspect a compromise, treat credentials stored on the device as exposed—revoke sessions, change passwords, bring in security analysts, and use a loaner device where possible so the original can be preserved for investigation.
Indicators of compromise include specific exploit URLs, command-and-control endpoints, SHA-256 hashes of malicious JavaScript loaders, and evidence of keychain data dumps. These artifacts can persist even after reboots or system updates.
Why this matters:These exploit kits mark a turning point in iPhone security threats. The ability to break out of a browser sandbox and grab kernel-level access shifts the attacker’s capabilities dramatically. For users, every visit to a website carries risk unless defenses are current. Tech companies and defenders need to stay ahead—rapid patching, strong access controls, and better detection methods are non-negotiable.
