Coruna, DarkSword iOS Exploits Proliferate Globally

The report describes the proliferation of two advanced iPhone exploit chains, DarkSword and Coruna, which were originally linked to nation-state and surveillance vendors but are now being adopted and modified by cybercriminals; researchers observed ~17,000 domains hosting second‑generation variants, multiple active CVEs spanning iOS 13–18, and capabilities including remote code execution, sandbox escapes, process injection, data exfiltration, and cryptocurrency wallet theft, with hybrid “Darkuna” variants combining techniques from both frameworks.