Coruna and DarkSword kits steal iPhone data from one web visit
Zimperium found 608 domains serving version-specific chains, including a backdoored npm package that infects visitors of otherwise ordinary sites.
84
Organization
Zimperium
- Mentions · 7d3
- Mentions · 30d5
- All mentions17
- First seenAug 22, 2026
- Last mentioned17h ago
Timeline
17 articles · newest firstDarkSword iOS chain escapes Safari and steals Apple Notes
Zimperium says a tested iOS 18.6.2 device uploaded NoteStore.sqlite and an inventory of 214 apps to attacker infrastructure.
76
MR ROBOT Android MaaS rents bank trojans aimed at Indian customers
CloudSEK says one affiliate’s data held 5,407 texts from 153 devices, with call forwarding on 58 percent.
64
Android Malware Exposes Its Own Operators While Hijacking Phones and Stealing Sensitive Data
Android RAT YuanKong leaks operator account IDs while abusing Accessibility and Wireless Debugging to control phones.
58
12 Best Mobile Application Security Testing Tools Compared (2026): Features & Pricing
A 2026 roundup compares 12 mobile AppSec tools for testing, shielding, and device virtualization.
16
RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims
Cleafy details RatHat Android banking trojan's malware-as-a-service console, which uses Google Gemini to rank victims by bank balance and guide on-device taps.
60
A Fake Streaming App Turned Android Phones Into Remote-Controlled Devices
Zimperium says StreamRat, spread by fake Spanish TV-app ads, can remotely control Android phones and steal logins.
62
Gemini broke into 3 companies, but Google kept it quiet because ‘no damage was done’
A Google Gemini AI agent broke into three companies by accessing credentials in public repositories due to cybersecurity tests by Irregular on behalf of AI giants including Google.
70
RatHat Android Trojan Uses AI for Automation
Zimperium says RatHat, an Android trojan, uses generative AI to control devices and steal banking credentials.
72
RatHat Turns Android Accessibility Into an Attack Weapon
Zimperium details RatHat, a China-linked Android trojan abusing Accessibility, wireless debugging, and generative AI to steal banking credentials and persist on phones.
65
RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall
Zimperium details RatHat, a China-linked Android malware using smishing, Accessibility abuse, local ADB self-pairing, and generative AI to persist after uninstall and steal data.
62
New RatHat Android malware uses AI to automate device control
Zimperium discovered RatHat, an AI-assisted Android banking trojan linked to Chinese actors, stealing credentials via overlays and intercepting SMS one-time passwords.
65
RatHat Abuses Android Wireless Debugging to Gain Shell Access and Steal Banking PINs
New Android banking trojan RatHat abuses Wireless Debugging to gain shell access and steals banking PINs and OTPs via raw touch capture.
72
New Android Ransomware Records Screens, Steals OTPs and Secretly Takes Photos of Victims
Zimperium uncovered Mantax Otax, an Android ransomware that encrypts files, records screens, steals OTPs, and secretly photographs victims.
45
Mantax OTAX Android Ransomware Spies on Users, Steals OTPs and Encrypts Files
New Android malware family Mantax OTAX combines ransomware, spyware, and OTP theft via sideloaded APKs, linked to Indonesian threat actors.
46
ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On
Zimperium and IBM Trusteer report expanded ToxicPanda 2.0 and GoldDigger Android banking trojan campaigns now targeting 349 financial institutions across 16 countries.
70
ToxicPanda 2.0 Gets a Major Upgrade, Expanding Attacks Across 16 Countries
Zimperium documents ToxicPanda 2.0, an Android banking trojan now targeting 349 financial institutions in 16 countries via ADB privilege escalation and overlay credential theft.
65
Related CVEs
by mentions- CVE-2022-485033%8.8Apple Web Content Bounds-Check Flaw Enables Code Execution Across iOS, macOS, Safari
Appears with
- Zimperiumvendor · 9
- Androidproduct · 8
- RatHatmalware · 7
- zLabsorganization · 3
- ToxicPandamalware · 2
- StreamRatmalware · 2
- Googleorganization · 2
- Safariproduct · 2
- Corunamalware · 2
- DarkSwordmalware · 2
- iOSproduct · 2
- SafeDeporganization · 2
- WeChatproduct · 2
- Mantax Otaxmalware · 2
- Geminiai model · 2
- Alipayproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.