DarkSword iOS Chain Bypasses Safari to Steal Notes
First merged summary.
Zimperium reports DarkSword chain exfiltrates Apple Notes from iOS 18.6.2 devices without prompts.
Zimperium's zLabs identified the DarkSword exploit chain for iOS 18 and later, which bypasses Safari sandbox without install or prompt to reach WebContent, GPU process and mediaplaybackd. Tested on iOS 18.6.2 device, it exfiltrated NoteStore.sqlite and inventory of 214 apps via 144 POSTs. Coruna-family code served on 608 domains through October 2026, including backdoored art-template npm package. All CVEs patched; Apple issued iOS 18.7.7 update.
- 608 domains serve Coruna-family code through October 2026
- DarkSword affects iOS 18+; exfiltrated Notes and 214 apps on 18.6.2 device
- Tested device made 144 HTTPS POSTs to ccsigen321qc[.]com
- Backdoored art-template npm package found by SafeDep
- CVE-2022-48503 and others now patched
- Apple released iOS 18.7.7 update for DarkSword
What each outlet adds
beyond the shared facts- GBHackersSpecific domains and staging hosts for DarkSword analysis
- Cyber Security NewsLure types and 93 domains matched to 21 tracking servers
- CVEs
- CVE-2022-48503
- Vendors
- Apple
Coverage
oldest first · one row per article · UTC- · 4d ago
GBHackersFirst report
DarkSword iOS chain escapes Safari and steals Apple Notes
Zimperium says a tested iOS 18.6.2 device uploaded NoteStore.sqlite and an inventory of 214 apps to attacker infrastructure.
- · 4d ago
Cyber Security News
Coruna and DarkSword kits steal iPhone data from one web visit
Zimperium found 608 domains serving version-specific chains, including a backdoored npm package that infects visitors of otherwise ordinary sites.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-48503 | Apple Web Content Bounds-Check Flaw Enables Code Execution Across iOS, macOS, Safari | 8.8 | 3% | KEV | KEV |