Nation-State iPhone Exploit Chains Coruna and DarkSword Are Now in Cybercriminals' Hands

How the DarkSword and Coruna iPhone exploit chains are spreading among cybercriminals — and which iOS versions are safe.

By Content Team

Aug 11, 2026

ON THIS PAGE

Two sophisticated iPhone exploit chains — Coruna and DarkSword — have escaped nation-state and mercenary containment and are spreading fast among ordinary cybercriminals. iVerify has tracked roughly 17,000 domains hosting second-generation versions of both, with infections continuing months after public disclosure earlier this year.

DarkSword targets iOS 18.4 through 18.6.2 using six known CVEs, stealing everything from iCloud data to crypto wallets. Devices on iOS 18.7.3 or later are not vulnerable. Coruna, the older chain (thought to have cost $30–40M to build), hits iOS 13–17.2.1 via watering-hole attacks. Threat actors are blending both into hybrid variants iVerify has informally dubbed "Darkuna." Researchers expect to see more mass exploitation as the chains spread.

Update to the latest iOS version now — both chains rely on vulnerabilities Apple has already patched.

Source: Dark Reading

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?