Hackers have deployed two potent exploit kits, Coruna and DarkSword, to infiltrate iPhones and extract sensitive information—with no user action required beyond visiting a web page. Zero-click exploits like these eliminate prompts, avoid app installs, and work even if the user doesn’t suspect a thing.
How the Attacks Unfold
Cybersecurity researchers uncovered roughly 608 malicious domains delivering Coruna-family code. These sites adapt the exploit chain based on the visitor’s iOS version: devices on iOS 17.2.1 or earlier are attacked via Coruna; devices on iOS 18 and newer get hit with DarkSword chains. All of this was revealed in a technical report published October 29, 2026, by analysts working with Zimperium’s zLabs team.
The initial lure is a seemingly benign web page—examples include dating sites targeting Brazil, Nigeria, Indonesia; AI companion chat services; crypto promos; streaming content; or fake casino pages. A hidden iframe or frame runs exploit code in the background. In some cases, users are prompted to “Open in browser”—getting them out of apps like TikTok where code execution may be restricted and into Safari, the trigger path for the attack.
Chains, Capabilities, and What Gets Stolen
For older iPhones (iOS 17.2.1 or earlier), Coruna abuse relies on a WebAssembly flaw (CVE-2022-48503) in Safari to read/write browser memory, bypass Apple’s pointer authentication, and gain kernel-level access. Exploits also disable code-signing protections, erase crash logs, and scrub website history to hide activity.
DarkSword, used on iOS 18-based devices, begins with browser compromises, then escapes into the GPU process and mediaplaybackd (Apple’s media service). In testing on iOS 18.6.2, attackers made 144 command-server contacts and downloaded modules capable of stealing Telegram local storage, the Apple Notes database, and metadata about installed apps—214 in one case.
How They’re Delivered and Who’s at Risk
The exploits spread not only via lure websites, but through supply chain attacks. Coruna code was found inside a backdoored version of the art-template package (an npm module) used by many developers. A fake jQuery file loaded from a Google look-alike domain on a comic-site did something similar. That means a visitor doesn’t necessarily land on a lure site to get infected.
Although the original Coruna toolkit was believed to have been developed by a nation-state actor for targeted use, its leak has allowed widespread adoption by multiple threat groups. Some of the recovered code included comments in Chinese, but researchers warn these do not reliably tie to attribution—they may only indicate where parts of the toolkit were authored or tested.
Protections & Indicators
All vulnerabilities exploited in both chains have been patched. Apple pushed an expanded iOS 18.7.7 update to extend protection against DarkSword to more devices. Users should verify their iPhones are updated to the latest iOS build. High-risk individuals—journalists, activists, executives—should enable Lockdown Mode, and treat unexpected prompts like “Open in Safari” as warning signs, not casual advice.
Security teams should enforce patched iOS across devices (including personal ones used for work), employ mobile threat defense tools, and keep diagnostic logs, since attackers delete local traces. Site owners need to audit third-party scripts and enforce strict Content Security Policies.
Indicators of compromise include specific domain names and URLs (such as those used for exploit modules or command-and-control servers), known loader hashes (for example cecd08aa6ff548c2), and unusual JavaScript namespaces (like globalThis.obChTK).
Analysis: Why This Matters & What to Watch
These Coruna and DarkSword campaigns mark a significant escalation in web-based zero-click threats for iOS devices. Where past exploits required downloading apps or clicking clear-cut lures, these kits work silently, tapping into real infrastructure and supply chains. The risk is amplified not just for individual users but for entire networks, especially when even trusted sites can serve up hidden threats.
What to watch: how quickly Apple users adopt the patched iOS versions, whether we’ll see additional supply chain compromises, and if threat actors evolve to circumvent current mitigations like Lockdown Mode. Enterprises must assume that even visiting trusted domains could be risky—defenses should focus on behavior and version hygiene, not just URL filtering.
