Coruna and DarkSword kits steal iPhone data from one web visit
Original title: Hackers Use Zero-Click Coruna and DarkSword Exploits to Steal Sensitive Data From iPhones
Zimperium found 608 domains serving version-specific chains, including a backdoored npm package that infects visitors of otherwise ordinary sites.
Zimperium’s zLabs said attackers use the Coruna and DarkSword iPhone exploit kits so that opening a web page, with no install or prompt, can steal private data. Sites select Coruna for iOS 17.2.1 or older and a DarkSword chain for iOS 18. Coruna uses the already-fixed Safari flaw CVE-2022-48503, then kernel access; a tested iOS 18.6.2 phone pulled modules and exfiltrated Notes and app data. Apple issued an expanded iOS 18.7.7 update to block DarkSword. Who operates the kits is unclear.
Unconfirmed: Who deployed the kits is unconfirmed; Zimperium says Chinese-language comments do not identify the operator.
- Researchers matched 93 domains to 21 tracking servers.
- Lures included dating, AI-chat, crypto, streaming, and casino pages.
- On iOS 18.6.2 the phone contacted its server 144 times and pulled seven modules.
- SafeDep found Coruna code in a backdoored art-template npm package.
- A fake jquery.min.js on a look-alike Google domain also started Coruna.
Impact: Theft of Notes, Telegram storage, and installed-app data
| Product | Affected | Fixed in |
|---|---|---|
| Apple iOS | 17.2.1 or older; iOS 18 including 18.6.2 | 18.7.7 |
| Apple Safari | — | — |
- 1.Install the newest iOS offered, including the expanded iOS 18.7.7 update.
- 2.High-risk users should enable Lockdown Mode.
- 3.Site owners should audit third-party scripts and enforce a strict Content Security Policy.
- CVEs
- CVE-2022-48503
- ATT&CK
- T1189 Drive-by CompromiseT1203 Exploitation for Client ExecutionT1195.002 Compromise Software Supply ChainT1070 Indicator Removal
- Vendors
- Apple
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-48503 | Apple Web Content Bounds-Check Flaw Enables Code Execution Across iOS, macOS, Safari | 8.8 | 3% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 3x3br.eu.cc | frames Domain xxtg1[.]eu[.]cc Brazilian dating lure Domain 3x3br[.]eu[.]cc Lure telling TikTok users to leave the app Domain 66wc[ |
| domain | 66wc.eu.cc | Config on xxtg1[.]eu[.]cc Campaign ID k7Xp3Rm9Qz Config on 66wc[.]eu[.]cc Domain ccsigen321qc[.]com DarkSword C2 for modules, che |
| domain | a111.life | ok-alike Google CDN serving a fake jquery.min.js Domain/URL a111[.]life/guard.html Frame that starts the Coruna chain Domain comm |
| domain | ajax.googleapls.com | d runtime Domain toongod[.]us Compromised comic site Domain ajax[.]googleapls[.]com Look-alike Google CDN serving a fake jquery.min.js Doma |
| domain | ax.xoovo.top | OS 18 chain Domain echomint[.]buzz AI-companion lure Domain ax[.]xoovo[.]top Casino-themed lure with hidden frame Domain www2[.]disp |
| domain | ccsigen321qc.com | .]cc Campaign ID k7Xp3Rm9Qz Config on 66wc[.]eu[.]cc Domain ccsigen321qc[.]com DarkSword C2 for modules, check-ins, and data theft Domai |
| domain | commoditytrendpilot.site | .]life/guard.html Frame that starts the Coruna chain Domain commoditytrendpilot[.]site Certificate link to related infrastructure Domain stocktr |
| domain | echomint.buzz | latibiru[.]win Site used to analyze the iOS 18 chain Domain echomint[.]buzz AI-companion lure Domain ax[.]xoovo[.]top Casino-themed l |
| domain | jiaoyou.eu.cc | ave the app Domain 66wc[.]eu[.]cc Coruna loader site Domain jiaoyou[.]eu[.]cc Variant with changed module loading Domain kjkp[.]com[. |
| domain | kjkp.com.cn | iaoyou[.]eu[.]cc Variant with changed module loading Domain kjkp[.]com[.]cn Adult-content site serving a shared runtime Domain qcsh |
| domain | melatibiru.win | vever3eds[.]com Central staging host for both chains Domain melatibiru[.]win Site used to analyze the iOS 18 chain Domain echomint[.]b |
| domain | qcsh.com.cn | com[.]cn Adult-content site serving a shared runtime Domain qcsh[.]com[.]cn Adult-content site serving a shared runtime Domain toon |
| domain | ssc.vever3eds.com | vrgrt4t33[.]com/log.html Exploit telemetry endpoint Domain ssc[.]vever3eds[.]com Central staging host for both chains Domain melatibiru[ |
| domain | stocktrendpilot.net | ot[.]site Certificate link to related infrastructure Domain stocktrendpilot[.]net Listed on the same certificate IP address 5[.]255[.]61[.] |
| domain | toongod.us | com[.]cn Adult-content site serving a shared runtime Domain toongod[.]us Compromised comic site Domain ajax[.]googleapls[.]com Loo |
| domain | vrgrt4t33.com | kSword C2 for modules, check-ins, and data theft Domain/URL vrgrt4t33[.]com/log.html Exploit telemetry endpoint Domain ssc[.]vever3ed |
| domain | www2.disp.cc | x[.]xoovo[.]top Casino-themed lure with hidden frame Domain www2[.]disp[.]cc Forum-style lure with off-screen frames Domain xxtg1[.] |
| domain | xxtg1.eu.cc | he malicious JavaScript Campaign ID 1DECX7UIQIB95 Config on xxtg1[.]eu[.]cc Campaign ID k7Xp3Rm9Qz Config on 66wc[.]eu[.]cc Domain |
| ipv4 | 5.255.61.234 | ktrendpilot[.]net Listed on the same certificate IP address 5[.]255[.]61[.]234 Linked to several dating lures in passive DNS File rc |
From the original article
4 min read at cybersecuritynews.com
Hackers are using two powerful iPhone exploit kits, Coruna and DarkSword, to break into phones and steal private data. The victim only has to open a web page. There is no app to install and no prompt to accept.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.