Two powerful iPhone exploit kits, Coruna and DarkSword, show how a visit to a malicious or compromised website can put an outdated device at risk.

The kits can link several software flaws together to break out of the browser and reach deeper parts of iOS. Depending on the device’s software version and the kit used, an attacker may then steal sensitive information without needing the user to install an app or tap through extra prompts.

These are not ordinary malicious webpages. An exploit kit is a set of tools that checks a visitor’s device and selects code designed for its software.

Coruna contains five complete exploit chains and 23 exploits targeting iOS 13.0 through 17.2.1. DarkSword uses a six-flaw chain against iOS 18.4 through 18.7. The two kits target different iOS ranges, so the risk depends on the version installed.

Researchers from iVerify identified and studied DarkSword with Google and Lookout, and iVerify has also reported on newer variants in the wild.

In an investigation published in October 2026, its researchers described a modified strain called P7 DarkSword, which can steal keychain and cryptocurrency wallet data.

Coruna and DarkSword Exploit Kits

The attack starts when Safari loads a malicious page or content hidden inside a compromised website. The page checks the iPhone’s model and iOS version, then serves code suited to that device.

A WebKit or JavaScriptCore flaw can let the code run in the browser. Further flaws help it escape the browser’s safety limits and gain higher system access.

That chain matters because the browser normally runs in a restricted area called a sandbox. A sandbox is designed to limit what a webpage can reach.

Coruna and DarkSword use additional flaws to break past those limits; the later stages can reach kernel-level access, which gives the attacker much broader control over the device. Earlier Coruna exploit research describes the range of exploits and iOS versions involved.

The tools can then collect valuable data. Reporting on DarkSword describes theft of passwords, messages, browsing records, location information and cryptocurrency wallet contents.

iVerify’s P7 analysis adds on-device keychain collection and two-way communication with the attacker’s server. That information can put both personal accounts and work access at risk, especially when the phone holds saved credentials or is used to approve sign-ins.

From targeted tools to wider criminal use

Coruna’s history shows how a powerful exploit can move between different users. Google tracked its use from a surveillance customer to espionage activity against Ukrainian users and later to financially motivated campaigns using fake finance and cryptocurrency websites.

The kit’s final payload, called PlasmaLoader, is designed to target cryptocurrency wallets and search Apple Notes for recovery phrases.

DarkSword also moved beyond limited use after its source code was leaked publicly in 2026. That made the kit easier for other attackers to obtain and adapt.

Separate reporting has described attackers combining DarkSword’s route into a device with Coruna’s wallet-theft tools, a development covered in this DarkSword and Coruna platform report.

A public leak does not mean every copy works on every iPhone, but it can make reuse and changes easier. The threat can be difficult to spot. Some implants run inside normal system processes and may remove parts of their activity when finished.

Browser or network monitoring can also miss what happens after the exploit code reaches the device. iVerify reported that some DarkSword variants leave useful traces, including Safari history and crash logs, while Coruna artifacts may remain after a reboot or iOS update.

Installing the latest iOS update available for the device is the most important step. Updates close known flaws used in these chains; Apple has also issued security fixes for older supported devices. Users should check Settings for Software Update and install the version offered for their model.

Lockdown Mode can provide extra protection for people at higher risk, but it is not a replacement for updates. It works best when enabled before opening a malicious page and can limit some features.

Users should also avoid signing in through unexpected finance or cryptocurrency pages, even when a site looks familiar. Organizations should track iOS versions across work devices, review which accounts each phone can access and have a plan to isolate a suspected device for investigation.

If compromise is suspected, treat credentials stored on that phone as exposed: change them from a trusted device, revoke active sessions where possible and involve the organization’s security team. A loaner phone can help staff keep working while investigators preserve the original device.

Indicators of compromise (IoCs):-

Type	Indicator	Context
Exploit URL	`hxxps://cdn[.]gotoiphone[.]com`	P7 exploit delivery
Exploit URL	`hxxps://mzpo30[.]cam/assets/js/group[.]html`	P7 exploit delivery
C2 server	`hxxps://agdx53[.]cc`	Command-and-control server
C2 URL	`hxxps://js[.]gotoiphone[.]com/ios18`	P7 C2 endpoint
SHA-256	`c9f8bf92af34239f68e6be9bed945d6e9b4e2d5fc6883a501bc85e3c88a761b7`	`rce_loader.js` from `cdn[.]gotoiphone[.]com`
SHA-256	`eb6da327d5e456a594a066fda2140234ffad305fb204556477718dfce31afe81`	`rce_loader.js` from `mzpo30[.]cam`
SHA-256	`c6587d10462c81c66c0798378710f492c7725a91d86c8e541cf66211bff4abff`	`c2_agent.js` from `cdn[.]gotoiphone[.]com`
File artifact	`/private/var/tmp/keychain_c2_dump.json`	Keychain data dump
File artifact	`/private/var/tmp/p7_debug.log`	P7 activity log

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Coruna and DarkSword Exploit Kits Can Fully Compromise iPhones From a Single Web Visit appeared first on Cyber Security News.