MalwarePublished 29 Oct 2026

Inside Coruna and DarkSword Chains: From Web Lures to iOS Exploitation

Source AlienVault OTX General

Mentions 3 CVEs

Mentioned vulnerabilities

Description

The Coruna iOS exploit framework, evolving over seven months, uses two exploit chains targeting different iOS versions. It delivers malicious code through over 600 domains embedded in web pages without requiring app installation or user consent. The framework includes advanced native modules capable of kernel memory manipulation, Apple Mobile File Integrity state changes, process memory reads, encrypted command-and-control communication, and artifact deletion. A supply-chain compromise via the npm package art-template enables delivery through legitimate application infrastructure, bypassing domain-based defenses.

Impact

This exploit framework enables remote compromise of iOS devices through drive-by web attacks without requiring user consent or app installation. It can manipulate kernel memory and security states, read process memory, and maintain encrypted command-and-control channels, potentially allowing persistent and stealthy control over affected devices. The supply-chain compromise increases the attack surface by leveraging legitimate application infrastructure, complicating detection and mitigation.

Defensive guidance

No specific patch or remediation guidance is provided in the available data. Due to the supply-chain nature and web-based delivery, mitigation may require updates to iOS, WebKit, and npm package management practices once official fixes are released.

Indicators of compromise

Domains 10

ax.xoovo.top
ccsigen321qc.com
echomint.buzz
melatibiru.win
a111.life
commoditytrendpilot.site
kjkp.com.cn
qcsh.com.cn
stocktrendpilot.net
www2.disp.cc

URLs 2

http://a111.life/guard.html
http://vrgrt4t33.com/log.html

Hashes 1

bbe0aa67e3d9d968220cd57f8f0ad4e676a4e968031b8ad2697fac40b1a68008

CVEs 3

CVE-2024-23222
CVE-2022-48503
CVE-2023-43000

Community reviews

Loading reviews…