CVE-2026-31001MalwarePublished 7 Oct 2026Updated 6 Nov 2026

DarkSword/Coruna Open Directory Finding

Source AlienVault OTX General

Compare

Severity

Unrated

Not a vulnerability record

Exploitation: Not in CISA KEV, no exploitation reported

Data as of 6 Nov 2026, 21:05 UTC

Description

The DarkSword/Coruna iOS exploitation platform was found exposed via open directories on five hosts, revealing an active commercial exploitation-as-a-service operation targeting cryptocurrency wallets. The platform extracts BIP39 recovery phrases from 18 different wallet applications and automates theft. Analysis uncovered victim data and an agent/reseller model. A separate China-based operator uses identical tooling on independent infrastructure, indicating multiple threat actors. The infrastructure was actively polling Chinese iOS devices during analysis. Development targeting iOS 26 via CVE-2026-31001 was identified but not yet deployed.

Impact

The exploitation platform enables theft of cryptocurrency wallet recovery phrases (BIP39), which can lead to full compromise and theft of cryptocurrency assets from affected users. The agent/reseller model suggests a scalable commercial operation with multiple operators leveraging the platform. The active infrastructure polling iOS devices indicates ongoing targeting of Chinese iOS users. The undeployed exploit targeting iOS 26 could increase impact if weaponized. No confirmed exploitation in the wild is reported yet.

Defensive guidance

Since the platform was exposed via open directories, securing and removing publicly accessible directories hosting exploitation tooling is critical to prevent further compromise or intelligence leakage. Users of affected cryptocurrency wallets should ensure their devices are updated with the latest iOS security patches and avoid installing untrusted applications. Monitor vendor advisories for updates on CVE-2026-31001 and related vulnerabilities. No active exploitation is currently confirmed, so immediate emergency patching is not indicated.

Indicators of compromise

Domains 7

escofiringbijou.com
hdios.cn
northlab.cn
fc.rsqqq.top
g.northlab.cn
machinest.onlinefc.top
manager.g.northlab.cn

URLs 1

https://66ds.lol

Hashes 2

1334417664270db20af705f422878c53c8378203
864d68e64618d6bfc26d75d6f780ae0b7bfed3698cc8333818ed32519e560d1f

CVEs 3

CVE-2025-31200
CVE-2025-24201
CVE-2026-31001

Community reviews

Loading reviews…