Leaked DarkSword and Coruna kits infect employee iPhones
One DarkSword chain started from an Instagram ad and targeted iOS 18.4.0 through 18.7.2 to steal Keychain data and crypto.
Stories per day · 30 days
9 RSS
Relatedapple39ipados12android9macos9software-release7coregraphics6coruna6exploit-kit6apt295beta5darksword5safari5sandbox-escape5watering-hole5binance4bluetooth4cryptocurrency4imessage4
112 stories, newest first · one card per story
Stories tagged #ios
Public iOS sandbox escape can read other apps' files
Binance says worse_query hits iOS 26.7.1, 27.0.1 and 27.2; no attacks are reported and Apple has not confirmed a fix.
1
Apple patches nine flaws across iOS, macOS, watchOS and visionOS
Updates cover iMessage group access, Bluetooth and AirPlay pairing-code bypasses, and one lock-screen AirPlay issue limited to iOS/iPadOS 26.
Apple patches iMessage group-chat flaws and Bluetooth pairing bugs
iOS and iPadOS 27.2.1 also fix Brotli CVE-2026-111497, which CISA added to the Known Exploited Vulnerabilities catalog on October 27.
Apple iOS 27.2.1 fixes nine flaws in iMessage, Bluetooth, and AirPlay
The same release covers iPadOS 27.2.1; Apple does not say any of the nine flaws are exploited.
Apple patches nine iOS 27.2.1 and iPadOS 27.2.1 flaws, none exploited
Fixes include Bluetooth pairing-limit bypasses, AirPlay flaws, and iMessage group access; Apple reports no real-world use.
Kaspersky: mobile attacks fell in Q3 as banking Trojans led
Blocked attacks fell to 1,668,368, while 378,456 malicious packages included 119,688 mobile banking Trojans.
Apple lists iOS 27.2.1 (24B156) software release
The developer listing names build 24B156 and only offers downloads, with no security notes.
Apple accelerates Siri toward agentic AI with app integration
Apple plans to make Siri more agentic to track goals and handle ongoing tasks, with third-party app control expected in Spring.
APT29 uses watering hole attacks on mobile devices
Sekoia linked APT29 to a mid-October 2026 campaign targeting iOS and Android via hacked sites and compromised analytics service.
1
Kremlin-linked hackers exploit iOS and Android flaws to infect phones
Attackers injected JavaScript to profile devices and steal cookies, Wi-Fi passwords, and full device data from visitors to targeted sites including america250.org.
APT29 targets iOS and Android users with n-day exploits
APT29 uses compromised sites and lookalike domains to deliver n-day exploits stealing cookies and device data from iOS and Android users spotted in mid-October 2026.
2
APT29 hijacks web analytics script to deliver iOS and Android exploits
APT29 uses Plerdy SEO Tracker supply chain compromise to serve n-day exploits stealing cookies and device data from iOS and Android users in 2026.
7
APT29 uses fake US UK sites for iOS Android exploits
APT29 campaign hits iOS 16.7 18.5 and Android Chrome with patched n-day flaws via JavaScript injection and supply-chain compromise.
3
Russian Hackers Use N-Day Exploits in Zero-Click Attacks on iOS and Android
APT29 deploys n-day exploits via watering-hole sites on iOS and Android devices with no user interaction.
Apple products contain pointer authentication bypass vulnerability
iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain improper authentication vulnerability allowing arbitrary read and write capability.
Apple enables Siri AI access to third-party apps in iOS 27.3
Siri AI can now control third-party apps using natural language without naming them.
Apple releases Xcode 27.3 beta
Betas include security and bug fixes for developers.
Apple Intelligence is coming to China with iOS 27.3
A November 4 beta adds earlier features and Alibaba’s Qwen, not the new Siri; the full release is set for December.
Coruna and DarkSword kits steal iPhone data from one web visit
Zimperium found 608 domains serving version-specific chains, including a backdoored npm package that infects visitors of otherwise ordinary sites.
DarkSword iOS chain escapes Safari and steals Apple Notes
Zimperium says a tested iOS 18.6.2 device uploaded NoteStore.sqlite and an inventory of 214 apps to attacker infrastructure.
Fake Padre Terminal App Store app linked to $23,000 Solana theft
Researcher Iris says 27 wallets were drained after October 25, and theft continued after Apple removed the app.
1
ADEX: 52% of 2026 ad-fraud schemes use AI as cloaking share falls
Across 1.2 million campaigns, iOS scripts and messenger phishing rose while cloaking’s share of suspensions fell to about 45%.
Coruna iOS exploit kit in malicious ads seeks crypto seed phrases
ADEX says about 50 advertiser accounts delivered version-matched chains for iOS 13.0 through 17.2.1, mainly on older devices.
2