Apple iOS 18.7.7 reported to block DarkSword iPhone exploit chain
October 30: Cyber Security News reported Apple’s expanded iOS 18.7.7 update blocks DarkSword, named already-fixed CVE-2022-48503 in Coruna, and linked 93 domains to 21 trackers.
Apple’s iOS 18.7.7 is reported to block DarkSword, while Coruna and DarkSword still target unpatched iPhones through ads and sites.
iVerify and Report URI say Coruna and DarkSword still reach iPhones through Instagram ads, reclaimed analytics domains, and compromised sites. An employee phone got DarkSword P7 while only scrolling a World Cup ad. Devices on iOS 13.0–17.2.1 get Coruna, which uses patched Safari bug CVE-2022-48503; later builds can get a DarkSword chain that, Zimperium says, escaped Safari’s sandbox on a tested iOS 18.6.2 phone and uploaded Apple Notes data. Cyber Security News reports Apple’s expanded iOS 18.7.7 blocks DarkSword and that those CVEs were already patched. On roughly 50 advertiser accounts, Cyber Security News says ADEX did not prove Coruna delivery; GBHackers says ADEX said the accounts delivered the chains.
- DarkSword P7 infected an employee iPhone via a World Cup Instagram ad without a tap.
- DeadTag reclaimed analytics domains linked to an estimated 135 million monthly visits.
- Coruna covers iOS 13.0 through 17.2.1; later builds can receive a DarkSword-derived chain.
- Zimperium counted 608 delivery domains; a tested iOS 18.6.2 device uploaded Notes data.
- Cyber Security News says Apple’s iOS 18.7.7 update blocks DarkSword.
- Attempts against iOS 26 and 27 were described as largely nonfunctional.
Timeline
dated events in the reporting · oldest first- Oct 21, 2026iVerify and Report URI documented DarkSword P7 via an Instagram ad. · Cyber Security News
- Oct 30, 2026Zimperium said an iOS 18.6.2 test device uploaded Apple Notes data. · GBHackers
What each outlet adds
beyond the shared facts- Cyber Security NewsNames CVE-2022-48503 and Apple’s iOS 18.7.7 DarkSword block.
- GBHackersDescribes the iOS 18 sandbox escape and 144 uploads from the test device.
- DataBreaches.netCites Forbes, Scott Helme, and iVerify without naming the kits.
- CVEs
- CVE-2022-48503
Coverage
oldest first · one row per article · UTC- · 3d ago
Cyber Security NewsFirst report
Instagram ads deliver DarkSword spyware to vulnerable iPhones without a tap
iVerify and Report URI say DarkSword P7 and Coruna hit older iOS via ads and reclaimed domains, not proven on fully updated phones.
- · 3d ago
GBHackers
Instagram ads used to deliver Coruna and DarkSword to iPhones
The DeadTag operation also abuses expired analytics domains referenced by sites that together draw about 135 million monthly visits.
- · 3d ago
DataBreaches.net
Crypto thieves infect iPhones via ads on hundreds of compromised sites
iVerify says victims only need to view an ad, including one served on Instagram.
- · 2d ago
Ad platform says malware ads fingerprint iOS before payload
ADEX linked about 50 advertiser accounts by shared cloaking behavior and says that does not mean they delivered Coruna.
- · 1d ago
Coruna iOS exploit kit in malicious ads seeks crypto seed phrases
ADEX says about 50 advertiser accounts delivered version-matched chains for iOS 13.0 through 17.2.1, mainly on older devices.
- · 12h ago
DarkSword iOS chain escapes Safari and steals Apple Notes
Zimperium says a tested iOS 18.6.2 device uploaded NoteStore.sqlite and an inventory of 214 apps to attacker infrastructure.
- · 10h ago
Coruna and DarkSword kits steal iPhone data from one web visit
Zimperium found 608 domains serving version-specific chains, including a backdoored npm package that infects visitors of otherwise ordinary sites.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-48503 | Apple Web Content Bounds-Check Flaw Enables Code Execution Across iOS, macOS, Safari | 8.8 | 3% | KEV | KEV |