Threats tagged 'ghostknife'

The DarkSword/Coruna iOS exploitation platform was found exposed via open directories on five hosts, revealing an active commercial exploitation-as-a-service operation targeting cryptocurrency wallets. The platform extracts BIP39 recovery phrases from 18 different wallet applications and automates theft. Analysis uncovered victim data and an agent/reseller model. A separate China-based operator uses identical tooling on independent infrastructure, indicating multiple threat actors. The infrastructure was actively polling Chinese iOS devices during analysis. Development targeting iOS 26 via CVE-2026-31001 was identified but not yet deployed.