[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"post:coruna-and-darksword-zero-click-iphone-spyware-steals-data":3},{"post":4,"author":19,"controls":26,"vendors":27,"more":28},{"slug":5,"kind":6,"title":7,"excerpt":8,"cover_image_url":9,"cover_image_alt":10,"author_name":11,"published_at":12,"body_md":13,"author_title":14,"regulation_refs":15,"ai_assisted":16,"cover_ai_generated":17,"updated_at":12,"reading_minutes":18},"coruna-and-darksword-zero-click-iphone-spyware-steals-data","rapid-alert","Coruna and DarkSword: zero-click iPhone spyware steals data from a single web page visit","Two iPhone exploit kits, Coruna and DarkSword, infect phones from a single web page with no app and no prompt. Zimperium found 608 delivery domains. Apple has notified targeted users in 99 countries. Every CVE is already patched.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcoruna-and-darksword-zero-click-iphone-spyware-steals-data-9c36ddb3-cover.png","Coruna\u002FDarkSword rapid alert: Your iPhone on iOS 17 or 18? One web page visit and it is theirs.","Marcus Lenngren","2026-11-01T05:36:03.059+00:00","![Coruna\u002FDarkSword rapid alert: Your iPhone on iOS 17 or 18? One web page visit and it is theirs.](https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcoruna-and-darksword-zero-click-iphone-spyware-steals-data-9c36ddb3-card.png \"The rapid alert card: save it and share it with your team\")\n\n## What happened\n\nResearchers at Zimperium's zLabs team published a technical report on 29 October 2026 on two iPhone exploit kits, Coruna and DarkSword. Both are zero-click: the victim only has to open a web page. There is no app to install and no prompt to accept.\n\nZimperium found 608 domains delivering Coruna-family code. These sites check the iOS version on the phone and pick an exploit chain. iPhones on iOS 17.2.1 or older get the original Coruna kit. Newer iPhones on iOS 18 get a chain built from DarkSword. Analysts recovered both the browser code and the native payloads, and matched 93 of the domains to 21 tracking servers.\n\nSeparately, on 30 October Apple sent a fresh round of threat notifications to targeted users in 99 countries, saying it was tied to new attacks and distinct from the August wave. Apple did not name a spyware product, a delivery method or a flaw, and did not attribute the activity to any attacker or region. The country figures describe where notified users were located, not the number of confirmed infections.\n\n## Timeline\n\n- August 2026: Apple's last major batch of notifications covered 110 countries.\n- 29 Oct 2026: Zimperium publishes the Coruna and DarkSword report.\n- 30 Oct 2026: Apple notifies targeted users in 99 countries.\n- Ongoing: Operators replace their web infrastructure within days.\n\n## Am I affected?\n\nThe infection starts with a page that looks normal. Zimperium found dating sites built for users in Brazil, Nigeria and Indonesia, plus AI-companion chat sites, crypto promotions and streaming pages. A hidden frame loads the exploit while the visitor sees the decoy. Some pages tell TikTok users to tap \"Open in browser\" so the link opens in Safari, which is the browser the exploit needs.\n\nThe Coruna chain uses CVE-2022-48503, a WebAssembly flaw in Safari, to read and write browser memory, then bypasses pointer authentication. The DarkSword chain breaks out of the browser through the GPU process into mediaplaybackd, a system media service. In Zimperium's test on an iPhone running iOS 18.6.2, the phone contacted the command server 144 times and pulled seven extra modules. One module read Telegram's local storage. The phone sent out its Apple Notes database and a list of 214 installed apps.\n\nDelivery is not only through lure sites. SafeDep found matching Coruna code inside the backdoored art-template npm package. Any site using the bad versions served the exploit to its own visitors, so domain blocklists miss this route. Zimperium also spotted a fake jquery.min.js loaded from a look-alike Google domain on a comic site.\n\n## What to do now\n\n1. Update every iPhone. Open Settings, General, Software Update, and install the newest build offered for that device. Apple pushed an expanded iOS 18.7.7 update to more devices to block DarkSword.\n2. Enable Lockdown Mode for higher-risk users (journalists, activists, executives): Settings, Privacy & Security, Lockdown Mode. Update the device first.\n3. Require patched iOS builds on all devices, including personal phones used for work.\n4. Treat any unexpected \"Open in Safari\" prompt as a stop sign.\n5. If you received an Apple threat notification, treat it as a serious security event. Verify it by signing in to your Apple Account website and looking for the banner. Genuine notices never ask you to install apps or profiles, open files, or share passwords or codes. Contact Access Now's Digital Security Helpline for expert assistance.\n6. Site owners: audit third-party scripts and enforce a strict Content Security Policy.\n\n## How to hunt\n\n- Block and search for the named C2 and lure domains, including ccsigen321qc[.]com, sc[.]vever3eds[.]com and vrgrt4t33[.]com\u002Flog.html.\n- Watch for the URI paths \u002Fapi\u002Fpayload\u002Fget, \u002Fapi\u002Ftask\u002Fpull and \u002Fbeacon in proxy and DNS logs.\n- Flag odd crashes, unexpected restarts and disabled code signing with mobile threat defence tools.\n- Look for a blocked IPC directory creation attempt at \u002Fprivate\u002Fvar\u002Ftmp\u002Fc2_ipc.\n- Keep diagnostic logs for high-risk users, because the malware deletes local crash logs and Safari website data.\n\n## What does not help\n\nAdvice like \"watch for strange behaviour\" does not help here: nothing looks wrong on screen, and the malware deletes its own traces. Domain blocklists miss the npm supply-chain and compromised-site routes completely. Be cautious of companies offering paid solutions to spyware infections.\n\n## Sources\n\n- [Hackers Use Zero-Click Coruna and DarkSword Exploits to Steal Sensitive Data From iPhones](https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-use-zero-click-coruna\u002F), Cyber Security News, 30 Oct\n- [Apple notifications alert victims in 99 countries about mercenary spyware infections](https:\u002F\u002Fcyberscoop.com\u002Fapple-spyware-notifications-pall-mall-process\u002F), CyberScoop, 30 Oct\n- [Apple Warns iPhone Users in 99 Countries of Sophisticated Mercenary Spyware Attacks](https:\u002F\u002Fcybersecuritynews.com\u002Fapple-warns-iphone-users\u002F), Cyber Security News, 31 Oct\n",null,[],true,false,3,{"name":11,"slug":20,"same_as":21,"job_title":22,"photo_url":23,"short_bio":24,"linkedin_url":25},"marcus-lenngren",[],"Founder, ThreatNoir","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fauthors\u002Fmarcus-lenngren-ca3a2dad9da5.jpg","Founder of ThreatNoir. Security and technology leader: CTO and CISO in a regulated industry, head of applications, network and data centre at Schibsted Sverige, and today security engineering for a global retailer's SOC. CISSP, CISM and AAISM.","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fmarcuslenngren",[],[],[29,36,43],{"slug":30,"kind":6,"title":31,"excerpt":32,"cover_image_url":33,"cover_image_alt":34,"author_name":11,"published_at":35,"reading_minutes":18},"artex-ai-autonomous-agents-run-active-directory-attacks-at","ARTEX AI: autonomous agents run Active Directory attacks at machine speed against 200+ orgs","Chinese-linked actors are using the open-source ARTEX AI framework to automate Kerberoasting, DCSync and lateral movement. Google, Mandiant and CrowdStrike report attacks on over 200 organisations, with one breach reaching root in 12 minutes.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fartex-ai-autonomous-agents-run-active-directory-attacks-at-02704500-cover.png","ARTEX AI rapid alert: Still trust slow attacks to catch? A machine takes your domain in minutes","2026-11-03T04:23:57.557+00:00",{"slug":37,"kind":6,"title":38,"excerpt":39,"cover_image_url":40,"cover_image_alt":41,"author_name":11,"published_at":42,"reading_minutes":18},"xcpe-botnet-1-3m-android-tv-boxes-shipped-with-a-backdoor","XCPE botnet: 1.3M Android TV boxes shipped with a backdoor, Google and police disrupt it","Google, Japan's NPA and partners disrupted XCPE, a backdoor that OEM Videostrong allegedly built into Android TV box firmware, enrolling more than 1.3 million devices. Removing the app does not help: it reinstalls from a protected partition on reboot.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fxcpe-botnet-1-3m-android-tv-boxes-shipped-with-a-backdoor-305686fc-cover.png","XCPE botnet rapid alert: Bought a cheap Android TV box? The backdoor shipped inside it.","2026-11-03T04:18:31.219+00:00",{"slug":44,"kind":45,"title":46,"excerpt":47,"cover_image_url":48,"cover_image_alt":49,"author_name":11,"published_at":50,"reading_minutes":51},"package-security-without-starting-on-the-laptop","analysis","Package security in three steps, and why you do not have to start on the laptop","AI coding agents now pick and install packages on engineering machines in seconds, and few teams can say what was pulled in. A threat feed you can search this week, a registry firewall that fits the network you already run, and the endpoint last. Notes from a session with Socket.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fblog\u002Fai-1cc0747e-9558-4214-a9a4-10cae453ca38.png","A digital shield protects a data stream from threats, representing layered package security.","2026-10-31T07:07:36.208+00:00",4]