Skip to main content
Press slash or control plus K to focus the search. Use the arrow keys to navigate results and press enter to open a threat.
Reconnecting to live updates…

IoCs (Indicators of Compromise) for the Coruna iOS iPhone Web Malware Client Side Exploits Serving Web Malware Exploitation Kit

0
Medium
Published: Mon Mar 16 2026 (03/16/2026, 23:26:57 UTC)
Source: AlienVault OTX General

Description

The Coruna iOS iPhone Web Malware Exploitation Kit is a client-side attack framework targeting iOS devices through malicious web domains and URLs. It delivers JavaScript payloads designed to exploit vulnerabilities in iPhone browsers or iOS components, enabling malware installation or unauthorized access. The campaign operates a large network of active malicious domains serving these exploits, posing a significant risk to iPhone users browsing compromised or malicious websites. Indicators of compromise include hashes of JavaScript payloads and URLs, facilitating detection and response. Although no known exploits in the wild have been reported yet, the scale and sophistication of the infrastructure indicate a persistent threat. This malware kit leverages multiple attack techniques, including command execution, credential access, and exploitation of web vulnerabilities. The threat is assessed as medium severity due to the complexity of exploitation and the targeted platform. Organizations with iOS device users should prioritize monitoring for these IoCs and implement targeted defenses against client-side web exploits.

AI-Powered Analysis

AILast updated: 03/17/2026, 01:12:43 UTC

Technical Analysis

The Coruna iOS iPhone Web Malware Exploitation Kit is a sophisticated client-side attack platform targeting iOS devices, specifically iPhones, via web-based vectors. It uses malicious JavaScript payloads delivered through a broad network of compromised or malicious domains and URLs to exploit vulnerabilities in iOS browsers or underlying system components. The exploitation kit includes multiple client-side exploits that can execute arbitrary commands (T1059.007), steal credentials (T1133), exploit software vulnerabilities (T1190), and establish command and control communications (T1102.003, T1071.001). The campaign’s infrastructure is extensive, with numerous active domains and URLs identified as serving these payloads, indicating a large-scale operation. Indicators of compromise such as MD5, SHA-1, and SHA-256 hashes of the JavaScript payloads are provided to aid detection. While there are no confirmed reports of active exploitation in the wild, the presence of these IoCs and the scale of the infrastructure suggest a credible and ongoing threat. The exploitation kit targets client-side vulnerabilities, which typically require user interaction such as visiting a malicious website. The threat leverages web malware tactics to bypass iOS security controls, potentially leading to unauthorized data access, device compromise, or persistent malware installation. The lack of specific affected iOS versions suggests the kit may target multiple or unknown vulnerabilities. The campaign’s use of numerous domains and URLs complicates detection and mitigation, requiring robust network and endpoint monitoring. Overall, this threat represents a significant risk to iPhone users, especially those in environments where web browsing cannot be tightly controlled.

Potential Impact

The Coruna iOS iPhone Web Malware Exploitation Kit poses a substantial risk to organizations and individuals relying on iOS devices, particularly iPhones. Successful exploitation can lead to unauthorized access to sensitive data, credential theft, and potential device compromise, undermining confidentiality and integrity. The client-side nature of the attacks means that users visiting malicious or compromised websites may inadvertently trigger exploitation, increasing the attack surface. For organizations, this can result in data breaches, loss of intellectual property, and erosion of user trust. The widespread network of malicious domains increases the likelihood of exposure, especially in sectors with high iPhone usage such as finance, healthcare, and government. Additionally, compromised devices could be leveraged for further attacks, lateral movement, or espionage. The absence of known exploits in the wild currently limits immediate impact, but the threat infrastructure’s scale suggests potential for rapid escalation. The medium severity rating reflects the balance between the complexity of exploitation and the significant consequences if successful. Overall, the threat could disrupt business operations, compromise user privacy, and impose remediation costs.

Mitigation Recommendations

To mitigate the threat posed by the Coruna iOS iPhone Web Malware Exploitation Kit, organizations should implement a multi-layered defense strategy tailored to client-side web exploits on iOS devices. First, maintain up-to-date iOS versions and apply all security patches promptly to reduce vulnerability exposure, even though specific affected versions are not listed. Deploy advanced web filtering solutions capable of blocking access to known malicious domains and URLs associated with this campaign, leveraging the provided IoCs including hashes and domain lists. Enable network-level monitoring and intrusion detection systems to identify and alert on suspicious traffic patterns related to command and control or exploitation attempts. Educate users about the risks of visiting untrusted websites and the importance of cautious web browsing on mobile devices. Utilize mobile device management (MDM) solutions to enforce security policies, restrict installation of unapproved apps, and monitor device integrity. Consider deploying endpoint detection and response (EDR) tools with capabilities to detect anomalous JavaScript execution or exploitation behaviors on iOS. Regularly update threat intelligence feeds to incorporate new IoCs from this and related campaigns. Finally, establish incident response procedures specifically addressing client-side web malware infections on iOS to enable rapid containment and remediation.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Author
AlienVault
Tlp
white
References
["https://securityboulevard.com/2026/03/iocs-indicators-of-compromise-for-the-coruna-ios-iphone-web-malware-client-side-exploits-serving-web-malware-exploitation-kit/"]
Adversary
null
Pulse Id
69b891c1dc6a9f2f666e3cc5
Threat Score
null

Indicators of Compromise

Url

ValueDescriptionCopy
urlhttp://ajskbnrs.xn--jor0b302fdhgwnccw8g.com
urlhttp://goanalytics.xyz
urlhttp://goodcryptocurrency.top/details/group.html
urlhttp://pepeairdrop01.com
urlhttp://pepeairdrop01.com/static/analytics.html
urlhttp://26a.online
urlhttp://26a.online/group.html
urlhttp://2s3b3rknfqtwwpo.xyz
urlhttp://3v5w1km5gv.xyz
urlhttp://3v5w1km5gv.xyz/group.html
urlhttp://4kgame.us
urlhttp://4kgame.us/group.html
urlhttp://4u.game
urlhttp://4u.game/group.html
urlhttp://65sse.668ddf.cc
urlhttp://65sse.668ddf.cc/tuiliu/group.html
urlhttp://6zvjeulzaw5c0mv.xyz
urlhttp://7ff.online
urlhttp://7ff.online/group.html
urlhttp://7fun.icu
urlhttp://7fun.icu/group.html
urlhttp://7p.game
urlhttp://7p.game/group.html
urlhttp://7uspin.us
urlhttp://7uspin.us/group.html
urlhttp://8fn4957c5g986jp.xyz
urlhttp://98a.online
urlhttp://98a.online/group.html
urlhttp://ai-scorepredict.com
urlhttp://ai-scorepredict.com/static/analytics.html
urlhttp://ajskbnrs.xn--jor0b302fdhgwnccw8g.com/gogo/list.html
urlhttp://anygg.liquorfight.com
urlhttp://anygg.liquorfight.com/88k4ez/group.html
urlhttp://appstoreconn.com
urlhttp://appstoreconn.com/xmweb/group.html
urlhttp://b27.icu
urlhttp://b27.icu/055c5ab6028f7c0a3f8970975c332fe4417b054c.js
urlhttp://b27.icu/25bb1b38371a67e977ed534d251d95b6f07aff90.js
urlhttp://b27.icu/2839f4ff4e23733e6ba132e639ce96d36d23c6b6.js
urlhttp://b27.icu/2cea19382f2b211e8caf609bc0bacc98f2557543.js
urlhttp://b27.icu/5aed00feae0b817db276377c1306e5fcae67cb95.js
urlhttp://b27.icu/7994d095b1a601253c206c45c120a80c4c0f3736.js
urlhttp://b27.icu/8d646979cf7f3e5e33a85024b6cf2bc81a6c5812.js
urlhttp://b27.icu/9e7e6ec78463c5e6bdee39e9f3f33d6fa296ea72.js
urlhttp://b27.icu/b903659316e881e624062869c4cf4066d7886c28.js
urlhttp://b27.icu/d715f1db179d73edcc180a8e376b3c17a09e389a.js
urlhttp://b27.icu/d9a260b1c2f63ab5e5aac4261d8a0be5a8b64da0.js
urlhttp://b27.icu/ee164f985cd9a7786dad6ca922b2de314dde9231.js
urlhttp://b27.icu/feeee5ddaf2659ba86423519b13de879f59b326d.js
urlhttp://b27.icu/group.html
urlhttp://b38w09ecdejfqsf.xyz
urlhttp://bestcryptocurrency.top
urlhttp://bestcryptocurrency.top/details/group.html
urlhttp://bet247.ac
urlhttp://binancealliancesintro.com
urlhttp://binancealliancesintro.com/group.html
urlhttp://btrank.top
urlhttp://btrank.top/tuiliu/group.html
urlhttp://cdn.uacounter.com
urlhttp://cdn.uacounter.com/stat.html
urlhttp://cryptocurrencyworld.top
urlhttp://cryptocurrencyworld.top/details/group.html
urlhttp://cy8.top
urlhttp://cy8.top/group.html
urlhttp://dbgopaxl.com
urlhttp://dbgopaxl.com/static/goindex/tuiliu/group.html
urlhttp://dd9l7e6ghme8pbk.xyz
urlhttp://dd9l7e6ghme8pbk.xyz/group.html
urlhttp://ddus17.com
urlhttp://ddus17.com/tuiliu/group.html
urlhttp://eg2bjo5x5r8yjb5.xyz
urlhttp://fxrhcnfwxes90q.xyz
urlhttp://fxrhcnfwxes90q.xyz/group.html
urlhttp://game.7p.game
urlhttp://gdvynopz3pa0tik.xyz
urlhttp://gem88.ac
urlhttp://gemwin.ac
urlhttp://goanalytics.xyz/88k4ez/group.html
urlhttp://goodcryptocurrency.top
urlhttp://gqjs3ra34lyuvzb.xyz
urlhttp://gunbet.ac
urlhttp://h4k.icu
urlhttp://h4k.icu/group.html
urlhttp://hfteigt3kt0sf3z.xyz
urlhttp://hui4tbh9uv9x4yi.xyz
urlhttp://i.binaner.com
urlhttp://i.binaner.com/group.html
urlhttp://i9-bet.ac
urlhttp://ios.teegrom.top
urlhttp://ios.teegrom.top/tuiliu/group.html
urlhttp://iphonex.mjdqw.cn
urlhttp://iphonex.mjdqw.cn/tuiliu/group.html
urlhttp://k96.icu
urlhttp://k96.icu/group.html
urlhttp://kanav.blog
urlhttp://kanav.blog/group.html
urlhttp://land.777bingos.xyz
urlhttp://land.777bingos.xyz/88k4ez/group.html
urlhttp://land.77bingos.com
urlhttp://land.77bingos.com/88k4ez/group.html
urlhttp://land.bingo777.now
urlhttp://land.bingo777.now/88k4ez/group.html
urlhttp://lddx3z2d72aa8i6.xyz
urlhttp://lddx3z2d72aa8i6.xyz/group.html
urlhttp://lk4x6x2ejxaw2br.xyz
urlhttp://lsnngjyu9x6vcg0.xyz
urlhttp://mkkku.com
urlhttp://mkkku.com/static/analytics.html
urlhttp://n49.top
urlhttp://n49.top/group.html
urlhttp://o08h5rhu2lu1x0q.xyz
urlhttp://ol67el6pxg03ad7.xyz
urlhttp://ose.668ddf.cc
urlhttp://ose.668ddf.cc/tuiliu/group.html
urlhttp://osec2.668ddf.cc
urlhttp://osec2.668ddf.cc/tuiliu/group.html
urlhttp://pen0axt0u476duw.xyz
urlhttp://res54allb.xn--xkrsa0078bd6d.com
urlhttp://res54allb.xn--xkrsa0078bd6d.com/group.html
urlhttp://rlau616jc7a7f7i.xyz
urlhttp://roy2tlop2u.xyz
urlhttp://sadjd.mijieqi.cn
urlhttp://sadjd.mijieqi.cn/group.html
urlhttp://sbet.ac
urlhttp://seven7.vip
urlhttp://seven7.vip/group.html
urlhttp://sf2bisx5nhdkygn3l.xyz
urlhttp://share.4u.game
urlhttp://share.4u.game/group.html
urlhttp://share.7p.game
urlhttp://share.7p.game/group.html
urlhttp://sj9ioz3a7y89cy7.xyz
urlhttp://sj9ioz3a7y89cy7.xyz/list.html
urlhttp://so5083.tubeluck.com
urlhttp://so5083.tubeluck.com/static/goindex/group.html
urlhttp://spin7.icu
urlhttp://spin7.icu/group.html
urlhttp://t7c.icu
urlhttp://t7c.icu/group.html
urlhttp://taisunwin.ac
urlhttp://tubeluck.com
urlhttp://uawwydy3qas6ykv.xyz
urlhttp://v2gmupm7o4zihc3.xyz
urlhttp://vvri8ocl4t3k8n6.xyz
urlhttp://w2a315.tubeluck.com
urlhttp://w2a315.tubeluck.com/static/goindex/tuiliu/group.html
urlhttp://xfal48cf0ies7ew.xyz
urlhttp://xittgveqaufogve.xyz
urlhttp://xjslbdt9jdijn15.xyz
urlhttp://xmmfrkq9oat1daq.xyz
urlhttp://y4w.icu
urlhttp://y4w.icu/group.html
urlhttp://yvgy29glwf72qnl.xyz
urlhttp://zcjdlb5ubkhy41u.xyz
urlhttp://ztvnhmhm4zj95w3.xyz

Hash

ValueDescriptionCopy
hash3839667917c078cd591a0396470df16e
hash402b7b34d8cb4ecc108a55e0a628accb
hash65df0396d5aabecdc3338ffb82896ce9
hash762045d2fb8cf416129ffce6d02decc3
hashd653c71ab2dba80a4a002d337603c5ec
hash0517b6fb594211cec82cc91f5ac9da1e154667cb
hash055c5ab6028f7c0a3f8970975c332fe4417b054c
hash089984a87eabdbe01d62fd21f5a3d60a5a2633aa
hash25bb1b38371a67e977ed534d251d95b6f07aff90
hash2839f4ff4e23733e6ba132e639ce96d36d23c6b6
hash2cea19382f2b211e8caf609bc0bacc98f2557543
hash5aed00feae0b817db276377c1306e5fcae67cb95
hash695168fe5ab38d5ffc759e07a3d8e5e777d107c7
hash7994d095b1a601253c206c45c120a80c4c0f3736
hash7c85d1644804f5a3695e5db537cb2afca7665d9c
hash8d646979cf7f3e5e33a85024b6cf2bc81a6c5812
hash9b62b3c1f26f6fb056be90b1c9fd4ffcbea22bbd
hash9e7e6ec78463c5e6bdee39e9f3f33d6fa296ea72
hashb903659316e881e624062869c4cf4066d7886c28
hashd715f1db179d73edcc180a8e376b3c17a09e389a
hashd9a260b1c2f63ab5e5aac4261d8a0be5a8b64da0
hashee164f985cd9a7786dad6ca922b2de314dde9231
hashfeeee5ddaf2659ba86423519b13de879f59b326d
hash01d6e008795b73a29359f92856bfeafef8210711c8a95f1cd2ab257f0a7492ba
hash52c510ecc3eed32f6f35c699474cb719c90482a2a4b37169cc478d2dbc0b8c89
hash8ac1175307ec784f367a0b21cd474c3bfc97d7b238ac4300ac5766ef45e63abb
hashc167b5f5e150f0ba855c038b4cf0dc7084c77ae2a70ba6248762e11f272c2ec1
hashea01377836441013d22112f4e5a7139c5ed0ebcf942d0836b9c088413e25692f

Domain

ValueDescriptionCopy
domain2s3b3rknfqtwwpo.xyz
domain3v5w1km5gv.xyz
domain4kgame.us
domain6zvjeulzaw5c0mv.xyz
domain7fun.icu
domain7uspin.us
domainai-scorepredict.com
domainappstoreconn.com
domainb38w09ecdejfqsf.xyz
domainbestcryptocurrency.top
domainbet247.ac
domainbinancealliancesintro.com
domainbtrank.top
domaincryptocurrencyworld.top
domaindbgopaxl.com
domaindd9l7e6ghme8pbk.xyz
domainddus17.com
domaineg2bjo5x5r8yjb5.xyz
domainfxrhcnfwxes90q.xyz
domaingdvynopz3pa0tik.xyz
domaingem88.ac
domaingemwin.ac
domaingoanalytics.xyz
domaingoodcryptocurrency.top
domaingqjs3ra34lyuvzb.xyz
domaingunbet.ac
domainhfteigt3kt0sf3z.xyz
domainhui4tbh9uv9x4yi.xyz
domaini9-bet.ac
domainkanav.blog
domainlddx3z2d72aa8i6.xyz
domainlk4x6x2ejxaw2br.xyz
domainlsnngjyu9x6vcg0.xyz
domainmkkku.com
domainol67el6pxg03ad7.xyz
domainpen0axt0u476duw.xyz
domainpepeairdrop01.com
domainrlau616jc7a7f7i.xyz
domainroy2tlop2u.xyz
domainsbet.ac
domainseven7.vip
domainsf2bisx5nhdkygn3l.xyz
domainsj9ioz3a7y89cy7.xyz
domaintaisunwin.ac
domaintubeluck.com
domainuawwydy3qas6ykv.xyz
domainv2gmupm7o4zihc3.xyz
domainvvri8ocl4t3k8n6.xyz
domainxfal48cf0ies7ew.xyz
domainxittgveqaufogve.xyz
domainxjslbdt9jdijn15.xyz
domainxmmfrkq9oat1daq.xyz
domainyvgy29glwf72qnl.xyz
domainzcjdlb5ubkhy41u.xyz
domainztvnhmhm4zj95w3.xyz
domain65sse.668ddf.cc
domainanygg.liquorfight.com
domaincdn.uacounter.com
domaini.binaner.com
domainios.teegrom.top
domainiphonex.mjdqw.cn
domainland.777bingos.xyz
domainland.77bingos.com
domainland.bingo777.now
domainose.668ddf.cc
domainosec2.668ddf.cc
domainres54allb.xn--xkrsa0078bd6d.com
domainsadjd.mijieqi.cn
domainso5083.tubeluck.com
domainw2a315.tubeluck.com

Threat ID: 69b8a719771bdb1749884ee8

Added to database: 3/17/2026, 12:58:01 AM

Last enriched: 3/17/2026, 1:12:43 AM

Last updated: 3/17/2026, 4:44:17 AM

Views: 14

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

External Links

Need more coverage?

Upgrade to Pro Console in Console -> Billing for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses