DarkSword and Coruna: iPhone Spyware Delivered Through Websites and Ads

#Overview

DarkSword and Coruna, the most capable iPhone spyware kits seen in the open, are not new. Google exposed both in March 2026, when the current iOS already had the fixes. What's new is who is using them, and how widely. On October 21 and 22, iVerify (opens in a new tab) and Report URI (opens in a new tab) described a criminal operation, DeadTag, that delivers both kits through abandoned analytics tags, hacked shops, and a malicious Instagram ad. On November 4, a new report (opens in a new tab) tied a separate watering-hole campaign, Poisoned Source, to the Russian state group APT29, which hijacked a Ukrainian web-analytics script loaded by thousands of sites. Its sites also serve Android phones a separate exploit chain through Chrome; DarkSword and Coruna themselves target only iPhones. In every case the attack is zero-click: loading a booby-trapped page, in Safari or in an app's built-in browser, is enough, with nothing to tap and no app to install.

The reassuring part: every vulnerability these kits are known to use is fixed in current iOS. They are n-day exploits, not zero-days. On iOS 26, all six of DarkSword's were fixed by 26.3; on iOS 18, the ones its chain needs were fixed by 18.7.3. Coruna's were fixed in iOS 17.3, with fixes back-ported to older iPhones in March. No working chain for either kit has been reported against an iPhone on a current release. The exposure is to devices that never updated. Sekoia's verdict: "This operation targets unpatched devices using n-days; a user running an up-to-date operating system is safe from these attacks."

Why it's urgent: these are not phishing pages or fake app installs; both kits attack the browser itself, and a successful hit hands the attacker the device. Report URI traced the dead tags it found to more than 660 re-registered domains still embedded on thousands of sites, drawing an estimated 135 million visits a month. Zimperium counted 608 domains delivering Coruna-family code through October. iVerify caught a live infection at one of its customers from a World Cup ad on Instagram, with no click. A newer DarkSword build leaked publicly on GitHub in March, putting it within reach of any criminal group. See the timeline.

#Key facts

#Who is affected

iPhones and iPads that haven't installed the newest release they can get. Both kits start in WebKit, the engine behind Safari and apps' built-in browsers. Check Settings → General → About → iOS Version, and find your line below.

Being outside a kit's documented range isn't the same as being safe. Zimperium says the delivery sites it studied send iOS 17.2.1 and older to Coruna and "devices running later iOS builds" to a DarkSword-derived chain, so those sites serve an exploit to iPhones on iOS 17.3 through 18.3 too, even though Google documents DarkSword working from 18.4. Every one of these lines has also gone without newer fixes: on iOS 18, Apple has shipped 18.7.9 through 18.7.11 only for the iPhone XS, XS Max, and XR, so an iPhone 11 or newer that stayed on iOS 18 last got a fix in 18.7.8, on April 22.

Apple published a plain-language note, Update iOS to protect your iPhone from web attacks (opens in a new tab), covering exactly this class of attack. It stresses that "devices with updated software were not at risk from these reported attacks," and that Lockdown Mode protects "even on out-of-date software." Lockdown Mode needs iOS 16 or later, though, so it isn't an option on an iPhone 6s, 7, or first-generation SE. For those, updating to 15.8.8 is the protection, and replacing the phone is the long-term fix.

#Android phones

DarkSword and Coruna are iPhone kits, but APT29's watering holes don't only serve iPhones. The same delivery servers send Android phones running Chrome 139 through 145, except 143, a separate chain. It gets code running in Chrome through a bug in Chrome's V8 JavaScript engine, escapes Chrome's sandbox through a flaw in Qualcomm's Adreno GPU driver, and runs a payload called AndroSnitch, which takes Chrome's cookies, history, and saved-logins database and the phone's saved Wi-Fi networks and passwords. Both bugs are in CISA's Known Exploited Vulnerabilities catalog:

When Google fixed the Chrome bug, it said "an exploit for CVE-2026-3910 exists in the wild." The Adreno fix reached Android in Google's August 2025 bulletin (opens in a new tab), under Qualcomm components, so it applies to phones with Qualcomm chips. A phone with a current Chrome and a security patch level of 2025-08-05 or later has both fixes. Phone makers ship Android updates on their own schedules, so check the date on the phone, not the Android version.

This is separate from Google's November 2026 Android bulletin (opens in a new tab), whose headline Critical flaw is CVE-2026-58868. That's a different bug in a different component, and the bulletin lists neither of this campaign's CVEs.

#How the attacks work

Both kits attack Safari's rendering engine from a web page. When a vulnerable iPhone loads a page carrying the kit, the exploit chain runs on its own: it gains code execution in the browser, escapes its sandbox, gains kernel access, and runs spyware. The victim sees a normal page. There is nothing to tap, no link to click, and no prompt. We don't publish the trigger conditions or any proof-of-concept code; what follows is how the kits reach victims and what they take, drawn from the researchers' own write-ups.

#How victims are reached

The campaigns share the same insight: a website's attack surface isn't only its own code. It's every third-party script and ad the page loads.

• Hijacked analytics scripts. APT29 compromised the Ukrainian analytics service Plerdy between August 27 and September 3, 2026, slipping a loader into a tracker script that thousands of websites, most of them Ukrainian, load. Every visitor to those sites fetched the attacker's fingerprinting script alongside the real analytics.
• Dead tags on live sites. Report URI's DeadTag campaign buys the expired domains behind analytics and ad tags that sites stopped using but never removed. The moment the operator owns the domain, every site still carrying the old tag starts serving the attacker's code. Report URI confirmed 660+ re-registered domains still embedded on thousands of sites.
• Lookalike proxy sites. Where APT29 couldn't compromise a site directly, it stood up reverse-proxy copies of high-profile sites (a US 250th-anniversary site, a London luxury hotel near UK government buildings) and injected its script into the pages as they passed through.
• Malicious ads. iVerify documented a DarkSword variant delivered through a World Cup–themed Instagram ad, which infected an employee's iPhone "while they were simply scrolling their in-app feed."
• Hacked shops. Report URI found the crew's DarkSword loader planted directly on hundreds of PrestaShop stores, hidden in a folder named to look like analytics code.

The code served is tiny and selective. It fingerprints the visitor, and only devices that match the attacker's criteria, and look like real phones rather than scanners, are served an exploit. To everyone else the page behaves normally, which is how the operation stayed hidden.

#The vulnerabilities

DarkSword's iOS 18 chain combines six Apple vulnerabilities. All six are fixed in current iOS, and all six are in CISA's Known Exploited Vulnerabilities catalog. We describe each at a high level; we don't publish how they're reached. The scores are CISA's, as NVD lists them.

Google says it reported these to Apple in late 2025 and that "all vulnerabilities were patched with the release of iOS 26.3 (although most were patched prior)." Apple says "The fixes associated with the DarkSword exploit first shipped in 2025," and made iOS 18.7.7 available to more devices on April 1 so that users with automatic updates would receive them. Coruna is older and broader: Google counted 23 exploits across five full chains covering iOS 13.0 to 17.2.1, and says it isn't effective against current iOS. Apple back-ported the oldest Coruna fixes (CVE-2023-41974, CVE-2024-23222, CVE-2023-43010) to iOS 15 and 16 devices on March 11.

APT29's Android chain uses two different bugs, in Chrome and in Qualcomm's GPU driver, covered above.

#What the spyware takes

Once DarkSword's chain succeeds, it drops a harvester that collects SMS and iMessage, the WhatsApp and Telegram databases, contacts, call history, Calendar and Notes, Safari history and cookies, keychain passwords and tokens, saved Wi-Fi passwords, Health data, location caches, the photo library, and iCloud Drive files. Report URI says the DeadTag crew's implants target crypto wallets, including Binance, Coinbase Wallet, OKX, Bitget, Trust Wallet, MetaMask, and wallets popular with Chinese-speaking users such as Bitpie and TronLink.

On persistence, the evidence is mixed. Sekoia says APT29's payloads ran "without establishing persistence," and Report URI says "A reboot of the phone may stop the active implant, but even if it does, by then, it's probably far too late." iVerify found that Coruna leaves artifacts that "persist across reboots and updates," so a reboot is not proof a device is clean.

#How we rate it

Apple publishes no severity ratings, so the overall rating here is Atlas'. We weigh who can reach the bugs, what they get, and whether anyone is exploiting them.

Overall: High. On an iPhone that never updated this is Critical-grade: a remote, zero-click chain that yields full device compromise, used in live campaigns by both a state actor and criminal crews. We don't rate it Critical because every flaw the kits are known to use is fixed in current iOS, no working chain has been reported against a current release, and updating closes every known one. The campaigns are also selective rather than indiscriminate: APT29 is pursuing espionage targets, and the DeadTag crew profiles for crypto holders. For most people the realistic risk is low, provided they update. CISA's scores for the individual CVEs, shown above, range from 5.5 to 8.8.

#Which devices are exposed

The exposure ranking that follows is our reading of the researchers' reports, not a confirmed exploit path for any specific device.

• Highest risk: an iPhone on iOS 18.4–18.7.2 or iOS 13.0–17.2.1 that browses the web or uses in-app browsers. That's the range where DarkSword and Coruna are documented to work, and where delivery sites target them. A crypto holder on such a device is the DeadTag crew's ideal victim, and anyone of interest to Russian intelligence who visited an affected Ukrainian or European site is APT29's.
• Also exposed: any other build that isn't the newest for its device. The delivery sites Zimperium studied serve iOS 17.3 through 18.3 a DarkSword-derived chain, and every older build lacks later fixes. An iPhone 11 or newer kept on iOS 18 also lacks the fix for CVE-2026-20700, which only iOS 26.3 and later carry.
• Android phones with Chrome 139–145, or a security patch level before 2025-08-05, whose owners visit sites in APT29's campaign. The full chain also needs a Qualcomm Adreno GPU.
• Lowest risk: an iPhone on 27.2, 26.7.2, or the newest release for its model. No working chain for either kit has been reported against it. Keep automatic updates on so it stays that way.
• A separate risk, for site owners: your visitors. If your site loads a script from a domain you no longer control, or carries an ad tag you've forgotten, you may be delivering one of these kits to your own visitors without any compromise of your server. Report URI's core finding is that this is already happening at scale.

Patch the oldest devices first, and treat any iPhone used by someone who holds significant crypto or who could be an intelligence target as a priority.

#How to check your systems

#Check an iPhone

There is no safe, reliable self-check for infection by these kits from the device itself; both actively hide, and Coruna detects analysis tools. The practical checks are:

1. Confirm the iOS version (Settings → General → About). If it isn't the newest release for your device in the table above, treat it as exposed until updated.
2. Confirm Lockdown Mode's state (Settings → Privacy & Security → Lockdown Mode) if the device can't be updated.
3. If you suspect a specific device was hit, iVerify publishes a free app, iVerify Basic, that scans for indicators of these kits and preserves device logs. We haven't independently tested it; we note it because iVerify authored the detection.

#Check an Android phone

1. Check Chrome's version: open Chrome, then Settings → About Chrome. 146.0.7680.75 or later has the V8 fix.
2. Check the security patch level: Settings → About phone → Android version, then read the "Android security update" date. 2025-08-05 or later includes the Adreno fix.

#Check your websites

This is where most readers can act. Both campaigns ride on third-party code that site owners forgot about. We tested these commands with GNU grep 3.8 against a sample site carrying script and iframe tags in every quoting style.

List the outside hosts a page loads scripts and iframes from:

url=https://www.example.com/curl -sL "$url" | grep -oiE "<(script|iframe)[^>]*src=[\"']?[^\"' >]+" \  | grep -oiE "(https?:)?//[^/\"' >]+" | sed -E 's#^(https?:)?//##' | sort -u

Remove any host whose service you no longer use. This reads the page as served, so it misses tags that a tag manager or another script adds after load (check those in the browser's network panel), and it can also list URLs that appear inside inline scripts. For a host you don't recognize, check when its domain was last registered. A recent date on an old tag's domain is the DeadTag signature:

curl -s https://rdap.org/domain/example.com \  | jq -r '.events[] | select(.eventAction=="registration") | .eventDate'

RDAP covers .com and the other generic domains, but some country-code domains, .io among them, have no RDAP service; use whois for those. Then look for the delivery domains the researchers published, in the served page and in your site's files, and check whether the site sends a Content Security Policy:

ioc='flux-telemetry\.com|clouds-stacks\.com|ecomtrack\.io'ioc="$ioc|araleads\.com|getmanyme\.com"curl -sL "$url" | grep -oiE "$ioc" | sort -u       # in the served pagegrep -rlE "$ioc" /var/www                         # in the site's filescurl -sI "$url" | grep -i '^content-security-policy'

The first two domains are APT29's; the rest are re-registered tag and loader domains that Report URI found. Plerdy's own tracker was compromised only between August 27 and September 3, so loading it isn't a sign by itself, but a site that loaded it that week exposed its visitors then. On a self-hosted shop, also look for JavaScript that appeared recently, which is how Report URI found the loader planted on PrestaShop stores:

find /var/www -name '*.js' -newermt '2026-08-01' -not -path '*/node_modules/*'

These are a starting point, not a substitute for continuous monitoring: DeadTag's script often returns nothing to a scanner and serves its payload only to a real phone on a residential connection, which is why Report URI had to retrace the chain repeatedly from rotating home IP addresses before it played out.

#How to fix

#Update iOS, then restart

Update every iPhone and iPad to the newest release it supports (Settings → General → Software Update), then restart it. As of November 4 that's iOS 27.2 or 26.7.2 on iPhone 11 and newer, 18.7.11 on the iPhone XS, XS Max, and XR, 16.7.16 on the iPhone 8 and X, and 15.8.8 on the iPhone 6s, 7, and first-generation SE. An iPhone 11 or newer that stayed on iOS 18 should move to 26 or 27, because Apple's iOS 18 updates after 18.7.8 in April are for older hardware only. Turn on Automatic Updates so the next round of fixes lands on its own, the way Apple pushed 18.7.7 to more devices in April.

#Turn on Lockdown Mode if you can't update

If a device can't be updated, or belongs to someone who could be targeted, enable Lockdown Mode (Settings → Privacy & Security → Lockdown Mode → Turn On & Restart). It needs iOS 16 or later. Apple designed it for "the very few individuals who… might be personally targeted by some of the most sophisticated digital threats," and says it protects against these attacks even on out-of-date software; Google says Coruna stops when it detects it. It blocks some web technologies and a few other features, so it changes the experience.

#Update Chrome and Android

Update Chrome from the Play Store, and install the newest security update your phone maker offers in the Settings app; the menu's location varies by maker. A Qualcomm phone whose last security update is older than 2025-08-05 stays exposed to the Adreno flaw, and if its maker has stopped shipping updates, replacing it is the fix.

#If you think a device was compromised

Report URI's guidance, which we'd echo: restart the phone, change every password stored in its keychain, and move any crypto to a new wallet with a new recovery phrase. Because DarkSword reads the keychain and these kits take session cookies, assume credentials and logged-in sessions are compromised, and rotate them from a different, trusted device. Keep an encrypted backup first if you want the phone analyzed; iVerify says Coruna's artifacts survive in one. For an enterprise fleet, a mobile EDR that can read device logs is the only way to confirm at scale.

#If you run websites

Treat this as a standing hygiene task, not a one-off:

• Remove unused third-party tags and ad snippets.
• Monitor your pages for new or changed scripts and new destination domains.
• Lock down which domains may serve code with a Content Security Policy, and alert on changes to it.

#Timeline and exploitation status

Exploitation status. Both kits are in active use by more than one operator. Sekoia attributes Poisoned Source to APT29 (also tracked as Midnight Blizzard or Cozy Bear), which it links to Russia's foreign intelligence service, "with moderate to high confidence," and calls DarkSword "a suspected Commercial Surveillance Vendor-developed iOS exploit kit." For DeadTag, Report URI says the traffic broker's operator is unknown, but that the iPhone exploit crew buying from it "reads like a financially motivated, Chinese-speaking crypto-theft operation," while noting none of that is proof. Censys (opens in a new tab) found exposed servers of another Chinese-speaking operation that sells access to the kits as a service, and recovered 11 victims' wallet recovery phrases from one. In those directories it also found an iOS 26 chain in progress, built around a JavaScriptCore bug it calls CVE-2026-31001, and says "the chain is mid-development and not yet deployed." That ID has no public CVE record, and Apple's notes don't list it, as of 11:10 AM CST, November 4, 2026. Google traced Coruna's own path through a commercial surveillance vendor, a Russian espionage group, and a China-based financially motivated actor. All six DarkSword CVEs and both Android CVEs are in CISA's KEV catalog as of 11:10 AM CST, November 4, 2026. We haven't tested any public proof of concept, and we aren't linking them.

#Updates to this post

We'll revise this post and mark it updated when any of these change: a new iOS release or an Apple advisory that names these kits, a working chain reported against iOS 26 or 27, a public record or Apple fix for CVE-2026-31001, a new campaign or attribution report, or a statement from Plerdy, Meta, or Apple on these campaigns.

#Get help

These campaigns turn a forgotten analytics tag or an unvetted ad into a weapon against your visitors, so it helps to know exactly what your own sites load. Our free security audit inventories every third-party script your pages pull in, checks them for Subresource Integrity and for CDNs known to be compromised, and grades your security headers, including Content Security Policy, for strength rather than mere presence.

#Sources