Loading story…
Censys uncovered five exposed open directories revealing a DarkSword/Coruna iOS exploitation and cryptocurrency-theft platform, including exploit stages, delivery infrastructure, administrative tools, and wallet-harvesting modules. DarkSword provides device access through browser exploitation, while Coruna injects wallet-specific theft modules into cryptocurrency applications and searches photos and Apple Notes for valid recovery phrases. A separate production-server capture contained 11 victim recovery phrases, 179 device-loot directories, and a 75-account roster, supporting researchers’ assessment of a Chinese-speaking commercial exploitation-as-a-service operation with reseller-style administration. These findings do not establish the total number of victims or cryptocurrency losses.
Telemetry showed sustained beaconing from two devices in China and Hong Kong. Researchers also identified a separate China-based operator through 22 samples from infections in the wild configured to communicate with 66ds[.]lol; neither operator was named. Development artifacts referenced unfinished iOS 26 exploitation associated with CVE-2026-31001, but researchers found no evidence that this chain was operational or deployed. A separate CoreAudio zero-click capability claim also remains unverified. Established exploit chains are reportedly patched, making current iOS updates a priority for organizations supporting iPhones, particularly devices used to access cryptocurrency wallets.
Pull IOCs and campaign context straight into your stack.
11 events from the most recent confirmed update back to the earliest known activity.
Censys published findings detailing wallet-module injection, recovery-phrase extraction from photos and Notes, and reseller administration capabilities. The report assessed the exposed cluster as a Chinese-speaking commercial exploitation operation distinct from previously documented DarkSword actors, without naming an operator.
The platform at 156.239.230[.]120 polled a device and remained operational during triage. It also served a Chinese-language watering-hole page displaying Telegram sales contact @v66db.
Telemetry recorded two devices running iOS 16.3.1 and iOS 16.1 polling every three seconds, producing 1,940 reports from Hangzhou and 2,749 from Hong Kong. Both sessions used zh-CN language headers and iPhone Safari user agents.
Between September 15 and September 17, Censys identified five previously undocumented hosts through its open-directory index. The exposed systems included a DS-Fusion distribution bundle, an operational command server, an analysis workspace, Coruna staging infrastructure, and a control platform.
Google Threat Intelligence Group first publicly documented the DarkSword/Coruna kit, which combines iOS exploitation with post-exploitation payloads.
Google Threat Intelligence Group observed multiple threat actors adopting the DarkSword/Coruna exploitation kit beginning in late 2025.
iVerify disclosed P7 DarkSword, a previously unseen variant that reduces on-device logging and processes stolen keychain data locally before exfiltration. Its SpringBoard implant supports bidirectional command-and-control, operating-system commands, arbitrary JavaScript execution, and extraction of cryptocurrency-wallet data, photos, and Notes.
Apple confirmed that DarkSword fixes had been extended to additional iOS 18 devices. Censys reported that the established 18.x exploit chains were patched in iOS 18.7.3 and iOS 26.3.
Development artifacts in an analysis workspace and production directory described CVE-2026-31001 as a JavaScriptCore type-confusion vulnerability, but companion sandbox and kernel stages were placeholders. Researchers found no evidence of deployed iOS 26 exploitation and could not verify a separate claimed CoreAudio zero-click capability.
Researchers identified 22 wild-build samples configured to communicate with 66ds[.]lol and distinguished their operator from the exposed-directory cluster. Certificate analysis linked the command infrastructure to origin 101.35.158[.]183 and Shenyang laboratory infrastructure, while two BitKeep modules expanded the observed wallet target set to 19.
Analysis of a separate production-server package revealed 11 victim recovery phrases, 179 device-loot directories, and 75 accounts with commissions and device quotas. The package's acquisition method was unknown, and the records did not establish the total victim count or cryptocurrency losses.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 41 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcecybersecuritynews.com
Open sourcecensys.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers from **Google**, **iVerify**, and **Lookout** disclosed **DarkSword**, a sophisticated iPhone exploit chain used in compromised websites to silently infect visitors, with observed targeting focused on **Ukraine** and additional activity tied to **Saudi Arabia, Turkey, and Malaysia**. The campaign is linked to suspected Russian operators, including activity tracked as **UNC6353**, and appears to support both **espionage** and **financial theft**, including the theft of saved passwords, text messages, and cryptocurrency wallet data. Reporting also indicates DarkSword is the second major iOS exploit kit recently found in the wild after **Coruna**, reinforcing concerns that advanced mobile exploitation is becoming more broadly operationalized rather than reserved for narrowly targeted, bespoke use. Technical analysis shows DarkSword used multiple chained vulnerabilities to achieve full device compromise on older iOS versions, including JavaScriptCore bugs **`CVE-2025-31277`** and **`CVE-2025-43529`** for remote code execution, **`CVE-2026-20700`** as a `dyld` PAC bypass, and sandbox escapes that pivoted from **WebContent** to the **GPU process** and then to `mediaplaybackd`. The exploit chain relied on first compromising **WebKit** and then abusing **WebGPU/ANGLE**-related paths to escape Safari’s sandbox, and Apple patched the flaws across later iOS releases including **18.6**, **18.7.3**, **26.2**, and **26.3**. Researchers warned that a substantial installed base of devices running **iOS 18 or earlier** remained exposed at the time of disclosure, making DarkSword notable both for its technical sophistication and for the scale of potentially vulnerable iPhones.
Sep 4, 2026
Researchers reported that the **Coruna** iOS exploitation framework contains full exploit chains and roughly **23 exploits** targeting iPhones running **iOS 13 through 17.2/17.2.1**, and that it has been used by multiple threat actors, including **UNC6353**, a suspected Russian espionage group conducting watering-hole attacks against Ukrainian users, and **UNC6691**, a financially motivated China-based actor. The toolkit, also referred to as **CryptoWaters**, has been described as a rare case of **nation-state-grade iPhone exploitation** appearing in broader criminal operations, with post-exploitation activity including the **PLASMAGRID** payload and persistence through a process identified as `com.apple.assistd` that injects into the `powerd` daemon running as root. Reporting also highlighted competing views on the toolkit's origin. One account said evidence suggests parts of Coruna may have originated from **Trenchant**, a hacking and surveillance division of **L3Harris**, and later leaked into the wider ecosystem, ultimately reaching foreign intelligence services and cybercriminals. However, technical threat research noted that the **definitive origin remains unconfirmed**, even as analysts observed reuse of vulnerabilities associated with **Operation Triangulation** and CISA added **`CVE-2023-41974`** to the **Known Exploited Vulnerabilities** catalog after Google's publication. The story is substantive threat intelligence, not fluff, because it concerns an active exploit framework, real-world exploitation, and possible proliferation of advanced offensive capabilities.
Jun 29, 2026
Hungary's National Cybersecurity Institute warned that **DarkSword**, a publicly available spyware and exploit kit for Apple devices, is targeting iPhones and iPads running `iOS 18.4` through `18.7` and corresponding `iPadOS` versions. The malware was described as easy to deploy after its code was released on a popular code-sharing platform, lowering the barrier for cyber-espionage activity. Once executed, DarkSword can steal contacts, messages, call history, authentication-related data, and other sensitive information, then exfiltrate it to attacker-controlled servers before deleting itself from the device to hinder detection. New reporting says the operation has since grown into a broad malicious web infrastructure spanning **180 web properties and 27 hosts**, using fake Apple sign-in pages, Apple-themed lures, and compromised websites to deliver a leaked six-vulnerability exploit chain and **GHOSTBLADE** data-theft modules. Researchers said successful compromise can expose keychain contents, iCloud data, Wi-Fi credentials, files, and Apple ID credentials, while operators rotate servers quickly and remove artifacts such as crash reports and `RemoteLog.log` to frustrate forensic analysis. Defenders were urged to apply Apple security updates, enable **Lockdown Mode** where patching is delayed, and monitor for recurring infrastructure fingerprints tied to the campaign.
Aug 4, 2026