Coruna and DarkSword kits steal iPhone data from one web visit
Zimperium found 608 domains serving version-specific chains, including a backdoored npm package that infects visitors of otherwise ordinary sites.
84
Malware
DarkSword
- Mentions · 7d4
- Mentions · 30d8
- All mentions12
- First seenSep 11, 2026
- Last mentioned18h ago
Timeline
12 articles · newest firstDarkSword iOS chain escapes Safari and steals Apple Notes
Zimperium says a tested iOS 18.6.2 device uploaded NoteStore.sqlite and an inventory of 214 apps to attacker infrastructure.
76
Instagram ads used to deliver Coruna and DarkSword to iPhones
The DeadTag operation also abuses expired analytics domains referenced by sites that together draw about 135 million monthly visits.
74
Instagram ads deliver DarkSword spyware to vulnerable iPhones without a tap
iVerify and Report URI say DarkSword P7 and Coruna hit older iOS via ads and reclaimed domains, not proven on fully updated phones.
72
APT28 breaches NATO naval shipbuilder, deploys reflective loader
Symantec says operators stole credentials two ways, opened an SSH tunnel and ran a new in-memory loader.
78
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More
Attackers exploited critical Atlassian flaw CVE-2026-21589 within hours, alongside arrests, malware updates, and certificate hijacks.
82
P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands
iVerify details P7 DarkSword, an iOS exploit kit that steals keychains and crypto wallets and accepts remote commands.
77
DarkSword iOS Exploit Platform Uses Coruna Malware to Steal Crypto Wallet Recovery Phrases
DarkSword's Coruna malware uses iOS browser exploits to steal cryptocurrency wallet recovery phrases from iPhones.
72
Mobile malware warning from Ukrainian researchers includes iPhone exploit kit
Ukraine warns Russian-aligned hackers are infecting military and officials' iPhones and Android phones for espionage.
76
Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks
Microsoft says Russian APT Star Blizzard now delivers backdoors through its RedFlick phishing chain.
76
Fake iPhone Duo preorder scam triggers DarkSword attack
A fake iPhone Duo preorder page uses the patched DarkSword chain to steal iPhone data on visit.
74
Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection
Anthropic disrupted APT29-linked GTG-20006, which used Claude to autonomously rebuild malware, hijack hotel Wi-Fi DNS, and target 20-plus Ukrainian, European, and US-linked organizations.
82
Related CVEs
by mentions- CVE-2025-242014%10.0WebKit Out-of-Bounds Write Sandbox Escape in Apple iOS, Safari, and macOS
- CVE-2025-3120021%9.8Memory Corruption in Apple iOS, iPadOS, macOS Audio Processing Enables Code Execution
- CVE-2026-2158999%9.3Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
- CVE-2022-485033%8.8Apple Web Content Bounds-Check Flaw Enables Code Execution Across iOS, macOS, Safari
Appears with
- iOSproduct · 8
- Applevendor · 8
- Corunamalware · 7
- iVerifyorganization · 4
- Safariproduct · 4
- Google Threat Intelligence Grouporganization · 3
- Microsoftvendor · 3
- iPhoneproduct · 3
- Censysorganization · 3
- Report URIorganization · 2
- SafeDeporganization · 2
- SpringBoardproduct · 2
- UNC6353threat actor · 2
- Star Blizzardthreat actor · 2
- UAC-0244threat actor · 2
- Zimperiumorganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.