Skip to content
NewA calmer, faster ZeroHour
Exploit / PoChighExploited in the wild

DarkSword iOS chain escapes Safari and steals Apple Notes

Original title: DarkSword iOS Exploit Chain Bypasses Safari Sandbox and Steals Apple Notes Data

GBHackersby Kavichselvan ()2 min read1
Read at gbhackers.com
Part of a story covered by 7 sourcesApple iOS 18.7.7 reported to block DarkSword iPhone exploit chainMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Zimperium says a tested iOS 18.6.2 device uploaded NoteStore.sqlite and an inventory of 214 apps to attacker infrastructure.

Zimperium zLabs says the Coruna iOS campaign now chooses between two exploit chains by iOS version. Devices on iOS 17.2.1 or earlier get the legacy Coruna framework; later builds get a DarkSword-derived chain that escapes Safari’s sandbox without an app install or prompt. On an iOS 18.6.2 device, the chain reached WebContent, the GPU process, and mediaplaybackd, then exfiltrated the Apple Notes database. Zimperium says every CVE in the chain is already patched.

Unconfirmed: Zimperium attributes the campaign and the Notes theft to its own device analysis; it does not name the individual CVEs.

Key facts
  • Through October 2026, zLabs counted 608 domains delivering Coruna-family code.
  • Google first documented Coruna in March 2026, covering iOS 13.0 through 17.2.1.
  • The iOS 18 chain was analyzed via melatibiru[.]win and staging host ssc[.]vever3eds[.]com.
  • The device made 144 HTTPS POSTs to ccsigen321qc[.]com, all answered with HTTP 200.
  • SafeDep found matching code in compromised npm package art-template; that infrastructure later went offline.
Security assessment · AI, from the articleExploited in the wild

Impact: Sandbox escape and theft of Apple Notes and app inventory

ProductAffected
Apple iOSiOS 17.2.1 or earlier for legacy Coruna; later builds, including analyzed iOS 18.6.2, for DarkSword-derived chain
What to do
  1. 1.Update iOS; Zimperium says every CVE in the chain is already patched.
  2. 2.High-risk users should enable Lockdown Mode.
  3. 3.Collect diagnostic logs before the malware deletes crash logs and Safari data.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
ATT&CK
T1189 Drive-by CompromiseT1059.007 JavaScriptT1041 Exfiltration Over C2 Channel
Tags
ioswebkitcorunadarksworddrive-byapple-notes
Vendors
Apple
Products
iOSSafari
Malware
CorunaDarkSword
Organizations
ZimperiumGoogle Threat Intelligence GroupSafeDep

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
domainccsigen321qc.comoth attempts. mediaplaybackd then sent a TLS ClientHello to ccsigen321qc[.]com, the C2 server configured in pe_worker.js. Coruna Campaig
domainmelatibiru.winsince gone offline. zLabs analyzed the iOS 18 chain through melatibiru[.]win, which pulled ten exploit scripts from the staging host s
domainssc.vever3eds.comwin, which pulled ten exploit scripts from the staging host ssc[.]vever3eds[.]com. On iOS 18.6.2, the loader runs rce_worker_18.6.js in a

From the original article

2 min read at gbhackers.com

Zimperium zLabs has found that the Coruna iOS exploit campaign now serves two iOS exploit chains, picked by the victim’s iOS version. A DarkSword-derived chain escapes Safari’s sandbox on newer iPhones and has stolen Apple Notes data. Recent coverage of Coruna and DarkSword spreading through Instagram ads and abandoned tags shows the kits are still […]

GBHackers

By Kavichselvan · gbhackers.com

Read the full article at GBHackers

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.