Zimperium Coruna and DarkSword Chains Target iOS Users via Web Exploits
Article Content
- •Coruna exploits target iOS devices without user consent or app installation.
- •Over 608 domains are involved in delivering the Coruna framework.
- •The exploit can be delivered via compromised npm packages, evading traditional defenses.
The Coruna iOS exploit framework has evolved, deploying two exploit chains based on the target's iOS version. Devices running iOS 17.2.1 or earlier are targeted with the legacy Coruna framework, while later versions face a DarkSword-derived chain. Over 608 domains have been identified delivering Coruna code, with configurations linked to 21 tracking collectors. The attack begins within a web page, loading the exploit without user consent or app installation. Notably, the exploit can also be delivered through compromised npm packages, bypassing the need for lure domains. As of October 2026, the campaign continues to adapt and expand its reach.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (5)
Following this threat?
Track Coruna and CVE-2022-48503 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which iOS versions are affected?
How is the exploit delivered?
What should organizations do to protect against this?
Continue Reading
Spyware Network Targets iPhones via Legitimate Websites Security researchers have identified a large-scale spyware campaign targeting iPhones, traced to a group called DeadTag. This operation affects at least 6,600 legitimate websites, which load malicious code without user interaction, enabling attackers to steal cryptocurrency wallet credentials. The spyware activates… 
P7 DarkSword Malware Targets iPhones for Crypto Wallet Theft Researchers have identified a new variant of the DarkSword malware, named P7 DarkSword, which targets unpatched iPhones to steal sensitive information, including cryptocurrency wallet data. Discovered by iVerify, the malware was found on a financial institution employee's device in August 2026. P7 DarkSword enhances…