What happened
Researchers at Zimperium's zLabs team published a technical report on 29 October 2026 on two iPhone exploit kits, Coruna and DarkSword. Both are zero-click: the victim only has to open a web page. There is no app to install and no prompt to accept.
Zimperium found 608 domains delivering Coruna-family code. These sites check the iOS version on the phone and pick an exploit chain. iPhones on iOS 17.2.1 or older get the original Coruna kit. Newer iPhones on iOS 18 get a chain built from DarkSword. Analysts recovered both the browser code and the native payloads, and matched 93 of the domains to 21 tracking servers.
Separately, on 30 October Apple sent a fresh round of threat notifications to targeted users in 99 countries, saying it was tied to new attacks and distinct from the August wave. Apple did not name a spyware product, a delivery method or a flaw, and did not attribute the activity to any attacker or region. The country figures describe where notified users were located, not the number of confirmed infections.
Timeline
- August 2026: Apple's last major batch of notifications covered 110 countries.
- 29 Oct 2026: Zimperium publishes the Coruna and DarkSword report.
- 30 Oct 2026: Apple notifies targeted users in 99 countries.
- Ongoing: Operators replace their web infrastructure within days.
Am I affected?
The infection starts with a page that looks normal. Zimperium found dating sites built for users in Brazil, Nigeria and Indonesia, plus AI-companion chat sites, crypto promotions and streaming pages. A hidden frame loads the exploit while the visitor sees the decoy. Some pages tell TikTok users to tap "Open in browser" so the link opens in Safari, which is the browser the exploit needs.
The Coruna chain uses CVE-2022-48503, a WebAssembly flaw in Safari, to read and write browser memory, then bypasses pointer authentication. The DarkSword chain breaks out of the browser through the GPU process into mediaplaybackd, a system media service. In Zimperium's test on an iPhone running iOS 18.6.2, the phone contacted the command server 144 times and pulled seven extra modules. One module read Telegram's local storage. The phone sent out its Apple Notes database and a list of 214 installed apps.
Delivery is not only through lure sites. SafeDep found matching Coruna code inside the backdoored art-template npm package. Any site using the bad versions served the exploit to its own visitors, so domain blocklists miss this route. Zimperium also spotted a fake jquery.min.js loaded from a look-alike Google domain on a comic site.
What to do now
- Update every iPhone. Open Settings, General, Software Update, and install the newest build offered for that device. Apple pushed an expanded iOS 18.7.7 update to more devices to block DarkSword.
- Enable Lockdown Mode for higher-risk users (journalists, activists, executives): Settings, Privacy & Security, Lockdown Mode. Update the device first.
- Require patched iOS builds on all devices, including personal phones used for work.
- Treat any unexpected "Open in Safari" prompt as a stop sign.
- If you received an Apple threat notification, treat it as a serious security event. Verify it by signing in to your Apple Account website and looking for the banner. Genuine notices never ask you to install apps or profiles, open files, or share passwords or codes. Contact Access Now's Digital Security Helpline for expert assistance.
- Site owners: audit third-party scripts and enforce a strict Content Security Policy.
How to hunt
- Block and search for the named C2 and lure domains, including ccsigen321qc[.]com, sc[.]vever3eds[.]com and vrgrt4t33[.]com/log.html.
- Watch for the URI paths /api/payload/get, /api/task/pull and /beacon in proxy and DNS logs.
- Flag odd crashes, unexpected restarts and disabled code signing with mobile threat defence tools.
- Look for a blocked IPC directory creation attempt at /private/var/tmp/c2_ipc.
- Keep diagnostic logs for high-risk users, because the malware deletes local crash logs and Safari website data.
What does not help
Advice like "watch for strange behaviour" does not help here: nothing looks wrong on screen, and the malware deletes its own traces. Domain blocklists miss the npm supply-chain and compromised-site routes completely. Be cautious of companies offering paid solutions to spyware infections.
Sources
- Hackers Use Zero-Click Coruna and DarkSword Exploits to Steal Sensitive Data From iPhones, Cyber Security News, 30 Oct
- Apple notifications alert victims in 99 countries about mercenary spyware infections, CyberScoop, 30 Oct
- Apple Warns iPhone Users in 99 Countries of Sophisticated Mercenary Spyware Attacks, Cyber Security News, 31 Oct
