Seven months after initial disclosure, the Coruna iOS exploit framework continues to evolve, now deploying two distinct chains based on device operating system version. Targets running iOS 17.2.1 or earlier receive the legacy Coruna framework, while later builds receive DarkSword-derived chains. Analysis identified 608 domains delivering Coruna-family code, with 93 sites mapping to 21 distinct tracking collectors. Distribution spans dating portals, AI-companion platforms, cryptocurrency promotions, media streaming services, and compromised legitimate sites. The attack requires no user interaction beyond loading a webpage, operating through hidden iframes that deploy browser exploits leading to native code execution. Recovered modules include kernel memory manipulation, code-signing enforcement changes, process memory access, encrypted command-and-control communication, and cleanup routines. One delivery vector involves compromised npm packages, enabling legitimate websites to serve exploits through their o...
The intelligence details indicators of compromise for the Coruna iOS iPhone web malware exploitation kit. It provides MD5, SHA-1, and SHA-256 hashes for detected JavaScript payloads. The analysis lists numerous active domains serving the malware, including specific URLs delivering client-side exploits. The campaign involves a wide network of malicious domains and URLs targeting iOS devices. The extensive list of compromised and malicious infrastructure demonstrates the scale of this exploitation kit's operations, highlighting the ongoing threat to iPhone users through web-based attacks.
