Zero-Click Coruna and DarkSword Exploits Target iPhones for Sensitive Data Theft
Hackers are leveraging zero-click exploit kits, Coruna and DarkSword, to compromise iPhones via malicious webpages, stealing sensitive data and covering their tracks.
Two sophisticated iPhone exploit kits, Coruna and DarkSword, are being actively used by threat actors to steal sensitive data from targeted devices, with victims only needing to visit a malicious webpage. Researchers from Zimperium's zLabs team have identified a significant campaign involving at least 608 domains distributing Coruna-family code. These domains host deceptive content, ranging from dating sites and AI companion chats to cryptocurrency promotions and streaming pages, all designed to lure unsuspecting users.
The exploit chains are dynamically selected based on the victim's iOS version. Older iPhones running iOS 17.2.1 or earlier are targeted by the original Coruna kit, which exploits a WebAssembly flaw in Safari (CVE-2022-48503) to gain memory access. This allows it to bypass pointer authentication protections and escalate privileges to the kernel level. Newer iPhones running iOS 18 are targeted by a chain built from the DarkSword exploit kit. This kit employs a multi-stage process, first compromising the browser and then escalating through the GPU process into the mediaplaybackd system service.
Once the exploit chain is active, the malware performs several malicious actions. It communicates with command-and-control (C2) servers using encrypted traffic, disabling certificate checks to evade detection. To cover its tracks, the malware deletes crash logs and Safari website data, making forensic analysis more challenging. In the case of DarkSword, Zimperium observed a compromised iOS 18.6.2 device contacting its command server 144 times and downloading seven additional modules. One module was specifically designed to exfiltrate data from Telegram's local storage, alongside a list of installed applications and the user's Apple Notes database.
The distribution methods for these exploit kits are varied and concerning. While many infections originate from direct visits to malicious websites, the Coruna code has also been found embedded in supply chain attacks. Specifically, the backdoored art-template npm package was identified as a delivery vector, meaning any website using vulnerable versions of this package would unknowingly serve the exploit to its own visitors. Additionally, attackers have been observed using fake JavaScript files, such as a malicious jquery.min.js file hosted on a look-alike Google domain, to initiate the exploit chain.
The origins of the Coruna and DarkSword kits remain somewhat obscured, though some recovered code contains Chinese-language comments. Zimperium attributes its findings to the code and infrastructure observed, noting that Coruna was initially developed by a nation-state actor before its leak led to wider proliferation. The threat actors behind these campaigns are actively replacing their web infrastructure, with DarkSword's C2 domains being replaced within days, as evidenced by data from Censys.
Given that all exploited vulnerabilities in these chains have been patched, the most effective defense is prompt patching of all iOS devices. Apple has released expanded updates, including iOS 18.7.7, to address DarkSword. Users, especially those at higher risk like journalists and activists, are advised to enable Lockdown Mode. General users should treat unexpected "Open in Safari" prompts with extreme caution and ensure their devices are running the latest available software. Organizations should enforce patched iOS builds and consider deploying mobile threat defense solutions to detect suspicious activity and maintain diagnostic logs for high-risk users.