Coruna reaches iOS 18: a new wave with the DarkSword chain

When Google Threat Intelligence Group (GTIG) disclosed the Coruna iOS exploit kit in March 2026, the numbers were already serious: five full exploit chains, 23 exploits in total, and iPhones running iOS 13.0 through 17.2.1 in the crosshairs. The one line that let us breathe a little was that the kit didn't work on current iOS.

Seven months later that line no longer holds. According to a report Zimperium zLabs published on 29 October, the Coruna family now also targets iOS 18.4 through 18.7.2, and it does so with a new chain called DarkSword.

What changed?

Zimperium found 608 domains delivering Coruna-family code through the end of October. Configurations on 93 of them point to 21 distinct tracking servers, which tells me we're looking at a distribution network with shared infrastructure rather than a handful of scattered sites.

What the sites do is simple and effective. They fingerprint the device first, then decide which chain to use based on the iOS version:

One inconsistency caught my eye in the report. The summary talks about 17.2.1 and earlier, while the technical section gives 17.0 through 17.1.x, and the report never reconciles the two.

A reminder from March: what was Coruna?

Delivery happens through a hidden iframe embedded in compromised or fake sites. The user only has to open the page; no extra click is needed. The kit first checks whether the device is real and learns its model and iOS version, then loads the matching WebKit RCE and PAC bypass.

The final payload is PlasmaLoader (PLASMAGRID in Google's naming), and it goes after data from crypto wallet apps such as Base, Bitget Wallet, Exodus and MetaMask. According to GTIG, the kit was used in July 2025 on Ukrainian sites by UNC6353, a suspected Russia-linked group. By December 2025 the user was UNC6691, a financially motivated cluster operating from China. CISA added CVE-2021-30952, CVE-2023-41974 and CVE-2023-43000 to its Known Exploited Vulnerabilities (KEV) catalog on 5 March 2026.

What does DarkSword do on the device?

What Zimperium saw on a test device running iOS 18.6.2 is fairly extensive. DarkSword gets kernel memory read/write and changes code-signing (AMFI) state. Its command and control traffic goes over HTTPS, encrypted with ChaCha20, with certificate validation turned off.

It also cleans up after itself by deleting WebKit diagnostic reports, JetsamEvent records, launchd.log and Safari website data. On top of that there's a separate module that parses Telegram's local storage looking for authentication material. From the test device, the Apple Notes database (NoteStore.sqlite) was exfiltrated along with an inventory of 214 installed apps.

How does it spread?

Most of the reported lures are places people are already inclined to tap. Dating portals built on Brazilian, Nigerian and Indonesian templates and AI-companion platforms top the list, followed by crypto promotions, casino content and media streaming sites.

The part that bothers me more is the legitimate sites. Compromised normal sites can carry the kit in a hidden iframe, and a compromised npm package (art-template) delivered the loader straight through a site's own JavaScript. TikTok links that arrive with "open in browser" previews are among the delivery channels too.

On the same day, ADEX reported a malvertising campaign built on Coruna. It ran through about 50 advertiser accounts, again went after iPhone and iPad users, and again ended at finance and blockchain apps.

What we know, what we don't

What's confirmed: 608 domains, version-based chain selection, targeting of iOS 18.4 through 18.7.2, going after Telegram and Notes data, and log deletion.

There's plenty we don't know. We don't know how many devices were compromised. There's no full list of the CVEs DarkSword uses either; Zimperium mentions only CVE-2022-48503 in the body of the report. Who developed the kit is also unclear. TechCrunch's report pointing to an L3Harris unit is, for now, a claim, and I don't treat it as a confirmed finding.

Do this now

1. Update iOS: Settings › General › Software Update. On its own, it's the most effective control against this campaign.
2. If you can't update, turn on Lockdown Mode: Settings › Privacy & Security › Lockdown Mode. According to GTIG, Coruna skips execution on devices in Lockdown Mode and in private browsing.
3. Treat any "open in Safari" prompt that pushes you out of an in-app browser as an alarm, and reach important sites through a bookmark or the official app.
4. Move recovery phrases, passwords and backup codes out of Notes and into a password manager.
5. In an organisation, require current iOS in conditional access, bring BYOD devices into scope, and extend web filtering to in-app browsers.
6. If you run a website, audit your third-party script dependencies and enforce a strict Content Security Policy, because the art-template case shows your site can carry this kit without you knowing.