DarkSword iOS Exploit Platform Uses Coruna Malware to Steal Crypto Wallet Recovery Phrases
DarkSword's Coruna malware uses iOS browser exploits to steal cryptocurrency wallet recovery phrases from iPhones.
72
Product
MetaMask
- Mentions · 7d0
- Mentions · 30d3
- All mentions12
- First seenSep 17, 2026
- Last mentioned24d ago
Timeline
12 articles · newest firstMalicious npm Packages Steal Browser Passwords, Discord Tokens and Crypto Wallets.
The MALFEX npm campaign ships Overlord RAT and movinlike to steal browser passwords, Discord tokens, and crypto wallets.
71
Metamask discloses security incident affecting its infrastructure
MetaMask disclosed an ongoing infrastructure incident and is exiting affected non-custodial staking validators.
58
MetaMask Security Incident Affecting Parts of Infrastructure
MetaMask is exiting Ethereum validators after an infrastructure compromise in its non-custodial staking stack, with no confirmed wallet threat.
60
Metamask discloses security incident affecting its infrastructure
MetaMask disclosed an ongoing infrastructure incident and is exiting Ethereum validators as a precaution.
58
SectopRAT Malware Hides in Legitimate Software to Steal Browser Credentials and Crypto Wallets
SectopRAT hides in tampered legitimate software and steals browser credentials and crypto wallets.
60
A Lightweight Ethereum Voting Prototype for Hospital Ethics Committees with Receipt-Based Inclusion Verification
Researchers prototype Ethereum voting for hospital ethics committees with public receipts but no secret ballots.
28
CLOSEDQUORUM, the malware that asks four AI models what to do next
Cisco Talos says CLOSEDQUORUM lets four commercial AI models vote on credential and wallet theft.
74
This Windows Malware is Built to Let Up to Four AI Models Vote on Its Next Move
Talos analyzed CLOSEDQUORUM, Windows malware that lets up to four AI models vote on its next action.
68
Researchers Find Malware That Uses AI Models Instead of Human Hackers for Control
Researchers find CLOSEDQUORUM, a Windows malware that uses commercial LLMs as an autonomous decision engine for post-compromise actions like credential theft.
65
New ClosedQuorum Windows malware uses AI for attack decisions
ClosedQuorum, a Go Windows implant, lets several LLMs choose post-compromise actions without a human operator.
62
Fake AI trading agent steals crypto wallet passwords
Fake AI crypto trading agent sites deliver Needle Stealer, which replaces browser wallet extensions to steal wallet passwords, HP reports.
65
Related CVEs
by mentionsAppears with
- Exodusproduct · 6
- Cisco Talosorganization · 4
- DeepSeekai model · 4
- Microsoft Edgeproduct · 4
- Firefoxproduct · 4
- Qwenai model · 4
- ClosedQuorummalware · 4
- Mistralai model · 4
- Discordproduct · 4
- Windowsproduct · 3
- Phantomproduct · 3
- Geminiai model · 3
- MetaMaskorganization · 3
- Googlevendor · 3
- Coinbase Walletproduct · 2
- MetaMaskvictim · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.