MalwarePublished 16 Mar 2026

IoCs (Indicators of Compromise) for the Coruna iOS iPhone Web Malware Client Side Exploits Serving Web Malware Exploitation Kit

Source AlienVault OTX General

Description

The intelligence details indicators of compromise for the Coruna iOS iPhone web malware exploitation kit. It provides MD5, SHA-1, and SHA-256 hashes for detected JavaScript payloads. The analysis lists numerous active domains serving the malware, including specific URLs delivering client-side exploits. The campaign involves a wide network of malicious domains and URLs targeting iOS devices. The extensive list of compromised and malicious infrastructure demonstrates the scale of this exploitation kit's operations, highlighting the ongoing threat to iPhone users through web-based attacks.

Impact

The Coruna iOS iPhone Web Malware Exploitation Kit poses a substantial risk to organizations and individuals relying on iOS devices, particularly iPhones. Successful exploitation can lead to unauthorized access to sensitive data, credential theft, and potential device compromise, undermining confidentiality and integrity. The client-side nature of the attacks means that users visiting malicious or compromised websites may inadvertently trigger exploitation, increasing the attack surface. For organizations, this can result in data breaches, loss of intellectual property, and erosion of user trust. The widespread network of malicious domains increases the likelihood of exposure, especially in sectors with high iPhone usage such as finance, healthcare, and government. Additionally, compromised devices could be leveraged for further attacks, lateral movement, or espionage. The absence of known exploits in the wild currently limits immediate impact, but the threat infrastructure’s scale suggests potential for rapid escalation. The medium severity rating reflects the balance between the complexity of exploitation and the significant consequences if successful. Overall, the threat could disrupt business operations, compromise user privacy, and impose remediation costs.

Defensive guidance

To mitigate the threat posed by the Coruna iOS iPhone Web Malware Exploitation Kit, organizations should implement a multi-layered defense strategy tailored to client-side web exploits on iOS devices. First, maintain up-to-date iOS versions and apply all security patches promptly to reduce vulnerability exposure, even though specific affected versions are not listed. Deploy advanced web filtering solutions capable of blocking access to known malicious domains and URLs associated with this campaign, leveraging the provided IoCs including hashes and domain lists. Enable network-level monitoring and intrusion detection systems to identify and alert on suspicious traffic patterns related to command and control or exploitation attempts. Educate users about the risks of visiting untrusted websites and the importance of cautious web browsing on mobile devices. Utilize mobile device management (MDM) solutions to enforce security policies, restrict installation of unapproved apps, and monitor device integrity. Consider deploying endpoint detection and response (EDR) tools with capabilities to detect anomalous JavaScript execution or exploitation behaviors on iOS. Regularly update threat intelligence feeds to incorporate new IoCs from this and related campaigns. Finally, establish incident response procedures specifically addressing client-side web malware infections on iOS to enable rapid containment and remediation.

Indicators of compromise

Domains 70

2s3b3rknfqtwwpo.xyz
3v5w1km5gv.xyz
4kgame.us
6zvjeulzaw5c0mv.xyz
7fun.icu
7uspin.us
ai-scorepredict.com
appstoreconn.com
b38w09ecdejfqsf.xyz
bestcryptocurrency.top

URLs 155

http://ajskbnrs.xn--jor0b302fdhgwnccw8g.com
http://goanalytics.xyz
http://goodcryptocurrency.top/details/group.html
http://pepeairdrop01.com
http://pepeairdrop01.com/static/analytics.html
http://26a.online
http://26a.online/group.html
http://2s3b3rknfqtwwpo.xyz
http://3v5w1km5gv.xyz
http://3v5w1km5gv.xyz/group.html

Hashes 28

3839667917c078cd591a0396470df16e
402b7b34d8cb4ecc108a55e0a628accb
65df0396d5aabecdc3338ffb82896ce9
762045d2fb8cf416129ffce6d02decc3
d653c71ab2dba80a4a002d337603c5ec
0517b6fb594211cec82cc91f5ac9da1e154667cb
055c5ab6028f7c0a3f8970975c332fe4417b054c
089984a87eabdbe01d62fd21f5a3d60a5a2633aa
25bb1b38371a67e977ed534d251d95b6f07aff90
2839f4ff4e23733e6ba132e639ce96d36d23c6b6

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 17 Mar 2026, 01:12 UTC

MITRE ATT&CK techniques7 from threat tags

Technical details

Indicators of compromise

Domains 70

URLs 155

Hashes 28

Community reviews

Related threats