iVerify reports leaked DarkSword and Coruna kits hit employee iPhones

What happened

According to Help Net Security, which cites iVerify’s 2026 Advanced Mobile Threat Report, criminals are using leaked exploit kits to break into vulnerable iPhones. Help Net Security reports that the attacks, delivered through ads and compromised websites, have reached employees who use phones for work. These are iVerify’s findings as relayed by one outlet; we have not seen the report itself. Help Net Security

Details Help Net Security attributes to the report:

• DarkSword chains several software flaws to compromise iPhones. Researchers disclosed it in March 2026, and a newer version appeared on GitHub within a week. Another toolkit, Coruna, was served from websites posing as finance and cryptocurrency services.
• A DarkSword variant began infecting an iPhone when an Instagram ad loaded as its user scrolled. The same person later clicked a link that delivered a different version. Researchers attributed the incidents to separate actors and assessed that both sought to steal cryptocurrency.
• DeadTag, a traffic-selling operation documented by Report URI researcher Scott Helme, acquired an expired domain once used for e-commerce analytics. Some stores still referenced it in their templates, so shoppers’ browsers fetched a script controlled by the new owner. One destination posed as a cryptocurrency trading site and loaded a hidden page that checked for Safari on iOS 18.4.0 through 18.7.2, then launched DarkSword on matching iPhones.
• A separate group bought traffic from DeadTag and deployed DarkSword and Coruna. Across the broader DeadTag network, thousands of websites loaded code from more than 660 re-registered domains. Report URI estimated that those sites received a combined 135 million visits a month.
• DarkSword can extract passwords and other sign-in information from the iPhone’s Keychain. One Coruna payload searched text and images for recovery phrases that could give control of a cryptocurrency wallet.
• Criminals seeking credentials or cryptocurrency accounted for three-quarters of detections. Every enterprise detection of DarkSword or Coruna involved an employee at or below managing-director level. The conservative estimate for monitored consumer iOS devices was 1.07 spyware infections per 1,000 devices.

Not confirmed: how many phones were infected (the researchers did not report this), any CVE identifiers for the chained flaws, and which iOS release fixes them. The source names none.

Am I affected?

Based on the report as relayed by Help Net Security, the exploit check targets Safari on iOS 18.4.0 through 18.7.2. Whether other versions are affected is not confirmed. The source says an employee’s phone used for work email, messaging or remote access could expose stolen credentials or session tokens to attackers. Help Net Security

The source also says some DarkSword traces last only briefly, and that a reboot or software update can remove the running malware and erase evidence. The researchers were unaware of any Apple threat notifications sent to devices where they had confirmed a DarkSword or Coruna infection, so the absence of an Apple alert is not a sign of safety.

What to do now

1. List employees who use iPhones for work email, messaging or remote access, including personal phones, and record their iOS versions. The reported exploit check covers iOS 18.4.0 through 18.7.2.
2. Check the vendor’s current iOS release notes for the fix. The source does not name a fixed version, so this is not confirmed here.
3. If you suspect a phone is infected, consider preserving evidence before rebooting or updating it. The source says either can erase traces.
4. Our reading of the Keychain finding, not a recommendation from the source: if an infection is suspected, review sign-ins and sessions for the work accounts on that phone.
5. Watch for further reporting. The report itself, any CVEs and Apple’s response are not confirmed in the source.

Sources

• Help Net Security: An Instagram ad was all it took: Leaked exploit kits are hitting employees’ iPhones