Two sophisticated iPhone exploit chains — Coruna and DarkSword — have escaped nation-state and mercenary containment and are spreading fast among ordinary cybercriminals. iVerify has tracked roughly 17,000 domains hosting second-generation versions of both, with infections continuing months after public disclosure earlier this year.
DarkSword targets iOS 18.4 through 18.6.2 using six known CVEs, stealing everything from iCloud data to crypto wallets. Devices on iOS 18.7.3 or later are not vulnerable. Coruna, the older chain (thought to have cost $30–40M to build), hits iOS 13–17.2.1 via watering-hole attacks. Threat actors are blending both into hybrid variants iVerify has informally dubbed "Darkuna." Researchers expect to see more mass exploitation as the chains spread.
Update to the latest iOS version now — both chains rely on vulnerabilities Apple has already patched.
Source: Dark Reading