DarkSword/Coruna iOS exploit kits: ads and hijacked sites steal iPhone credentials and crypto
Severity: high · Patch status: patched · Since 2026-11-11 · CVE-2025-14174, CVE-2025-31277, CVE-2025-43510, CVE-2025-43520, CVE-2025-43529, CVE-2026-20700
iVerify's 2026 Advanced Mobile Threat Report, as reported by Help Net Security on 2026-11-11, says criminals are running leaked DarkSword and Coruna exploit kits against iPhones. DarkSword first checks for Safari on iOS 18.4.0 through 18.7.2 and only then launches its chain, which can start from an ad-driven redirect. A traffic-selling operation called DeadTag bought an expired analytics domain; more than 660 re-registered domains then injected scripts into thousands of sites that together receive about 135 million visits a month. Google's March 2026 analysis, published with Lookout and iVerify, describes DarkSword as a six-CVE full-chain exploit used since at least November 2025 by several commercial surveillance and state-linked operators in Saudi Arabia, Turkey, Malaysia and Ukraine, and says all six were patched by iOS 26.3. About three-quarters of detections involved attackers seeking credentials or cryptocurrency, and every enterprise detection involved an employee at or below managing-director level. The researchers knew of no Apple threat notifications sent to confirmed victims. Exploitation is in the wild.
What to do
- Check iPhones, especially BYOD devices used for work, for signs of compromise; collect what you can before wiping or rebooting a suspect device
- Update iPhones to iOS 26.3 or later, the release Google GTIG says patched all six DarkSword CVEs; where an update is not possible, enable Lockdown Mode (GTIG recommendation)
- Enforce phishing-resistant MFA and conditional access so stolen passwords or session tokens alone cannot reach corporate services
- Restrict corporate email, messaging and remote access on personal phones, or require managed containers
- Monitor for anomalous logins consistent with credential or session-token theft
- Block or monitor traffic to newly re-registered domains and ad-driven redirects
Fixed versions
- iOS 26.3 (all six DarkSword CVEs, per Google GTIG)
- iOS 26.2 and 18.7.3 (CVE-2025-43529, CVE-2025-14174)
- iOS 26.1 and 18.7.2 (CVE-2025-43510, CVE-2025-43520)
- iOS 18.6 (CVE-2025-31277)
Sources
All live incidents on Threat Watch
