Zimperium zLabs has found that the Coruna iOS exploit campaign now serves two iOS exploit chains, picked by the victim’s iOS version. A DarkSword-derived chain escapes Safari’s sandbox on newer iPhones and has stolen Apple Notes data.
Recent coverage of Coruna and DarkSword spreading through Instagram ads and abandoned tags shows the kits are still spreading.
DarkSword iOS exploit chain
According to technical research published by Zimperium, devices on iOS 17.2.1 or earlier receive the legacy Coruna framework. Later builds receive the DarkSword-derived chain.
Through October 2026, zLabs counted 608 domains delivering Coruna-family code. Configurations from 93 of those sites map to 21 tracking collectors.
The lures include dating portals, AI-companion apps, crypto promotions and streaming sites. Some are compromised legitimate sites that load the kit through hidden iframes.
Google’s Threat Intelligence Group first documented Coruna in March 2026. It describes five exploit chains and 23 exploits covering iOS 13.0 through 17.2.1.
The victim installs no app and accepts no prompt. A decoy page renders normally while a hidden iframe loads the exploit. Some lures tell TikTok users to open the link in Safari, which is the environment the loader needs.
SafeDep found matching Coruna code in compromised versions of the npm package art-template. A site can therefore serve the kit through its own dependency tree, with no lure domain for blocklists to catch. The SafeDep write-up notes that the infrastructure it analyzed has since gone offline.
zLabs analyzed the iOS 18 chain through melatibiru[.]win, which pulled ten exploit scripts from the staging host ssc[.]vever3eds[.]com. On iOS 18.6.2, the loader runs rce_worker_18.6.js in a Web Worker.
The chain then crosses several privilege boundaries, achieving remote code execution in the unprivileged WebContent process, a sandbox escape through WebKit’s GPU process (sbx0), a pivot into mediaplaybackd, the media daemon (sbx1), and a post-escape worker that manages later payload stages.
zLabs saw both the GPU process and mediaplaybackd try to create /private/var/tmp/c2_ipc, and the sandbox blocked both attempts. mediaplaybackd then sent a TLS ClientHello to ccsigen321qc[.]com, the C2 server configured in pe_worker.js.
.webp)
The device fetched seven more JavaScript modules from the C2, including c2_agent.js and telegram_v1.js. The Telegram module is built to parse local storage and extract authentication material. zLabs recorded 144 HTTPS POST requests to the C2, all answered with HTTP 200.
The device uploaded the Apple Notes database (NoteStore.sqlite) and an inventory of 214 installed apps. The SpringBoard process initiated that connection.
The Coruna chain’s native modules use ChaCha20 encryption and HTTPS with certificate validation disabled. They also manipulate Apple Mobile File Integrity (AMFI) state and delete crash logs and Safari website data. Across 19 containers, researchers extracted 24 distinct binaries, twelve of which are version-specific kernel module builds.
Shared artifacts tie the infrastructure together. These include the 29,924-byte runtime, the globalThis.obChTK namespace and the loader identifier cecd08aa6ff548c2.
Every CVE in the chain is already patched, so updating iOS is the main defense. High-risk users should enable Lockdown Mode.
Security teams should enforce OS version policies, include BYOD devices, deploy mobile threat defense and collect diagnostic logs before the malware deletes them. The full indicators are in Zimperium’s IOC repository.
