Leaked DarkSword and Coruna kits infect employee iPhones
Original title: An Instagram ad was all it took: Leaked exploit kits are hitting employees’ iPhones
One DarkSword chain started from an Instagram ad and targeted iOS 18.4.0 through 18.7.2 to steal Keychain data and crypto.
iVerify’s 2026 Advanced Mobile Threat Report says criminals are using leaked exploit kits, DarkSword and Coruna, against vulnerable iPhones, including phones employees use for work. Infections arrived through ads and compromised or lookalike finance and cryptocurrency sites. DarkSword can take passwords and sign-in data from the Keychain; one Coruna payload searched for wallet recovery phrases. Researchers did not say how many phones were infected.
Unconfirmed: The infection count is unreported, and researchers had not seen Apple threat notifications for confirmed infections.
- DarkSword was disclosed in March 2026, and a newer build appeared on GitHub within a week.
- A hidden page checked for Safari on iOS 18.4.0 through 18.7.2 before launching DarkSword.
- DeadTag reused an expired analytics domain still referenced by store templates.
- Report URI estimated sites on more than 660 re-registered domains drew 135 million visits a month.
- About 1.07 spyware infections per 1,000 monitored consumer iOS devices was the conservative estimate.
Impact: Keychain credentials, messages, notes, photos and crypto recovery phrases
| Product | Affected |
|---|---|
| Apple iOS | 18.4.0 through 18.7.2 |
- 1.Treat work access from personal iPhones as exposed if a DarkSword or Coruna infection is suspected.
- Vendors
- Apple
- Threat actors
- DeadTag
- Organizations
- iVerifyReport URI
From the original article
2 min read at helpnetsecurity.com
Criminals are using leaked exploit kits to break into vulnerable iPhones, according to iVerify’s 2026 Advanced Mobile Threat Report. Attacks delivered through ads and compromised websites have reached employees who use phones for work. DarkSword chains together several software flaws to compromise iPhones.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.