Compromised npm Package Delivered Coruna-Like iOS Exploit Framework
Summary
Researchers traced malicious art-template npm versions 4.13.5 and 4.13.6 to a Safari-focused framework targeting iOS 11–17.2. It resembles Coruna, but analysis of the final exploit payload is ongoing.
Key points
- The compromised art-template package was taken over after its original maintainer transferred control; versions 4.13.5 and 4.13.6 injected remote scripts into browser builds.
- The injected scripts redirected visitors to a watering hole that loaded an obfuscated framework targeting Safari on iOS 11.0–17.2; it rejected iOS 17.3 and later.
- The framework fingerprinted devices and anti-automation signals, selected version-specific remote modules, and beaconed victims’ public IP addresses and device versions to a C2 server.
- Researchers found strong technical overlap with the Coruna delivery framework, including version targeting, content-addressed module URLs, and obfuscation methods.
- The final exploit payload and additional exploit-kit components were not confirmed; the article says analysis is ongoing. Attribution to UNC6691 remains unconfirmed.
- Recommended defenses include blocking the listed malicious domains, searching for campaign indicators in network logs, and restricting third-party scripts on managed iOS devices.
Article Details
- Attack Vectors
- According to original author aui, an unknown actor acquired art-template under the pretense of maintaining the project, released versions containing external scripts, and deleted related issue reports.
- art-template 4.13.3 concealed a remote-script loader with String.fromCharCode encoding. Versions 4.13.5 and 4.13.6 appended plaintext browser-side loaders to lib/template-web.js, exposing users of downstream applications to attacker-controlled JavaScript.
- The injected scripts redirected browsers to a watering-hole page hosting an iOS exploit qualification and staging framework.
- The framework selected remote modules using browser, operating-system version, CPU architecture, and WebAssembly runtime checks. Payload URLs were derived from a session key and module identifiers.
- Socket assessed the framework as an instance or close derivative of Coruna with high confidence. Actual exploitation and the terminal payload's behavior remained unconfirmed.
- Defensive Notes
- The source recommends blocking the C2 domain at DNS and proxy layers and blocking or alerting on the watering-hole domain family and its subdomains.
- Alert on a public-IP lookup followed within two seconds by a POST to an unrecognized API endpoint.
- Hunt proxy and DLP logs for the beacon tracking string CHMK6IG08F42496C22.
- The source recommends searching web proxy logs for cecd08aa6ff548c2 and matching the published content-addressed module paths.
- Treat JavaScript requests from the reported watering-hole domain to Safari iOS clients as suspicious.
- For iOS-heavy organizations, the source recommends MDM restrictions on third-party scripts from unmanaged domains and enforcing Safe Browsing on managed devices.
- Do not replay the implant in a browser-connected JavaScript environment: it retrieves live remote modules at runtime.
- The sample disables payload selection at iOS 17.3 and later. Static analysis of the qualification framework alone does not confirm successful exploitation.
- The source reports retrieving all 14 remote modules, but analysis of their terminal actions and correspondence to previously reported Coruna components remained ongoing.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cfww[.]shop | Domain family the source recommends blocking because it hosts suspicious delivery infrastructure. |
| DOMAIN | l1ewsu3yjkqeroy[.]xyz | C2 domain receiving victim public-IP and device-version beacons. |
| DOMAIN | utaq[.]cfww[.]shop | Watering-hole origin hosting the implant and remote payload modules. |
| DOMAIN | v3[.]jiathis[.]com | Supply-chain injection origin hosting the maliciously injected remote scripts. |
| MD5 | 6e79ae622b7ef30f31fdbcc2dc65339e | MD5 of the exploit delivery framework entry point. |
| SHA1 | 14669ca3b1519ba2a8f40be287f646d4d7593eb0 | SHA-1 content identifier for the implant's bundled fingerprinting and capability engine. |
| SHA1 | 171a7da1934de9e0efb9c1645f4575f88e482873 | Remote module content identifier for the desktop WebKit cryptographic getter. |
| SHA1 | 29b874a9a6cc9fa9d487b31144e130827bf941bb | Remote module content identifier for the wF8NpI cryptographic getter. |
| SHA1 | 477db22c8e27d5a7bd72ca8e4bc502bdca6d0aba | Remote module content identifier for shared cryptographic initialization. |
| SHA1 | 57620206d62079baad0e57e6d9ec93120c0f5247 | SHA-1 content identifier for the implant's bundled 64-bit mathematics module. |
| SHA1 | 57cb8c6431c5efe203f5bfa5a1a83f705cb350b8 | Remote module content identifier for the iOS 16.2–16.5 WASM loader. |
| SHA1 | 7d8f5bae97f37aa318bccd652bf0c1dc38fd8396 | Remote module content identifier for the iOS 11.0–15.1 WASM loader. |
| SHA1 | 7f809f320823063b55f26ba0d29cf197e2e333a8 | Remote module content identifier for the WASM-verified final action. |
| SHA1 | 8064d4e0322f069b3dba13e7957ff0ca7dab7984 | SHA-1 of the exploit delivery framework entry point. |
| SHA1 | 91b278ddb2aec817b10c1535e0963da74f9b8eeb | Remote module content identifier for the non-Safari WebKit cryptographic getter. |
| SHA1 | 9db8a84aa7caa5665f522873f49293e8eebccd5c | Remote module content identifier for the LJ1EuL cryptographic getter. |
| SHA1 | b586c88246144bc7975ad4e27ec6d62716bf34ea | Remote module content identifier for the fallback cryptographic getter. |
| SHA1 | ba712ef6c1bf20758e69ab945d2cdfd51e53dcd8 | Remote module content identifier for the WASM ABI sub-module. |
| SHA1 | c03c6f666a04dd77cfe56cda4da77a131cbb8f1c | Remote module content identifier for the primary final action. |
| SHA1 | d11d34e4d96a4c0539e441d861c5783db8a1c6e9 | Remote module content identifier for the iOS 15.6–16.1 WASM loader. |
| SHA1 | e3b6ba10484875fabaed84076774a54b87752b8a | Remote module content identifier for the primary iOS 16.6–17.2 WASM loader. |
| SHA1 | ea3da0cfb0a5bdb8c440dd4a963f94cbd39d9e44 | Remote module content identifier for the iOS 15.2–15.5 WASM loader. |
| SHA256 | 080da430f7e3a38d7cad59887df30d9ac40e70d203c7aa5f5afaf0cafcb73e5f | Retrieved file-content hash of the iOS 11.0–15.1 WASM loader. |
| SHA256 | 2c4a5a49a84f55db0dd5554f7a9e055dbb0eae3782986726c6dcfab84ecd6dc5 | Retrieved file-content hash of the iOS 16.2–16.5 WASM loader. |
| SHA256 | 2cfa14b2cd1f3fd51406cf1ac49c761a5c26ce3994e97de7f1ca469d85248a52 | Retrieved file-content hash of the WASM-verified final-action module. |
| SHA256 | 329ae1401819da4f87e3726b7e2707afcaf62d1219c4256c828df36af0a8784a | Retrieved file-content hash of the LJ1EuL cryptographic getter. |
| SHA256 | 473f182b8cbbdb5b4b29b7ad875014d66f1691ed2e770c633b559d97243895a7 | Retrieved file-content hash of the wF8NpI cryptographic getter. |
| SHA256 | 593548d714f6d48acb886d42bf576d8fd6b1ddae6f888dda0719671a53463663 | Retrieved file-content hash of the iOS 15.6–16.1 WASM loader. |
| SHA256 | 5c0ebd86d2e8ae2087c0a4def4e0364a0cfb85c7e0a753fc96dca55b6c303432 | Retrieved file-content hash of the WASM ABI sub-module. |
| SHA256 | 675a40df5f517f8f0cd99f74c5468f56d1d8f05003e997477a2af3bc7b0105a9 | Retrieved file-content hash of the fallback cryptographic getter. |
| SHA256 | 7b8436669563e7d317c219b26432bdaab70e39061ea2c1c70fcc201f2c19c470 | Retrieved file-content hash of the desktop WebKit cryptographic getter. |
| SHA256 | b0b29b6148c4b0dbd77d33f821ca01e2d7a711988b854285a2606dcc53894abe | Retrieved file-content hash of the iOS 15.2–15.5 WASM loader. |
| SHA256 | de1a07d8978725eaa6da5658e373e88264ac90515750201bfbe17947d5a9e788 | Retrieved file-content hash of the non-Safari WebKit cryptographic getter. |
| SHA256 | eaab0874332777ad8a03a292bcd608a3358547f9f16ab551d34eef35d5cd539e | Retrieved file-content hash of the primary iOS 16.6–17.2 WASM loader. |
| SHA256 | ebcc76dcd5ef596e732321a8d16eb2dee525c5d9a68c700b7885648c13c65a57 | Retrieved file-content hash of the primary final-action module. |
| SHA256 | f31bdd069fe7966ae11be1f78ee5dd44445938856dd1df12379e0e84a6851f5c | SHA-256 of the exploit delivery framework entry point 49554fde7424c31c.js. |
| SHA256 | feb9442c39619d7bb3ff29de8e1d4bebceb1b24f8c0a63da2f2b30a1023dc94f | Retrieved file-content hash of the shared cryptographic initialization module. |
| URL | hxxps[:]//l1ewsu3yjkqeroy[.]xyz/api/ip-sync/sync | C2 endpoint receiving victim public-IP and device-version beacons. |
| URL | hxxps[:]//utaq[.]cfww[.]shop/17480ecc0120292fb6b8b19f2fa134385dcfd0fd[.]js | Remote desktop WebKit cryptographic getter module URL. |
| URL | hxxps[:]//utaq[.]cfww[.]shop/3bc0f6865c0476c0a98a76cb9924d6b3972df591[.]js | Remote fallback cryptographic getter module URL. |
| URL | hxxps[:]//utaq[.]cfww[.]shop/3fd66b32c44150acff3dcb80f86c759574148ed5[.]js | Remote cryptographic getter module URL for the LJ1EuL path. |
| URL | hxxps[:]//utaq[.]cfww[.]shop/46ecd515ac9e99ef0603063db39303a0fd849632[.]js | Remote WASM loader URL selected for iOS 15.2–15.5. |
| URL | hxxps[:]//utaq[.]cfww[.]shop/4a75f0551eba446b4fa35127024a84b71d9688d6[.]js | Remote cryptographic getter module URL for the wF8NpI path. |
| URL | hxxps[:]//utaq[.]cfww[.]shop/5ff38f5342bb3c931bc504d6fa3523d0c8865b93[.]js | Remote WASM loader URL selected for iOS 11.0–15.1. |
| URL | hxxps[:]//utaq[.]cfww[.]shop/6beef463953ff422511395b79735ec990bed65f4[.]js | Primary remote WASM loader URL selected for iOS 16.6–17.2. |
| URL | hxxps[:]//utaq[.]cfww[.]shop/8835419f53fa3b270c8928d53f012d4c28b29ea4[.]js | Remote final-action module URL for the WASM-verified path; terminal behavior remained under investigation. |
| URL | hxxps[:]//utaq[.]cfww[.]shop/8c4451cf1258f9a8d6a8af27864f111fd69a0e99[.]js | Remote WASM loader URL selected for iOS 16.2–16.5. |
| URL | hxxps[:]//utaq[.]cfww[.]shop/9af53c1bb40f0328841df6149f1ef94f5336ae11[.]js | Remote primary final-action module URL; terminal behavior remained under investigation. |
| URL | hxxps[:]//utaq[.]cfww[.]shop/aea58f0e58801b528702a6c66bf4af8b99041243[.]js | Remote WASM ABI sub-module URL used by the architecture-specific dispatcher. |
| URL | hxxps[:]//utaq[.]cfww[.]shop/bef10a7c014b826e9dd645984e80baf313c1635f[.]js | Remote shared cryptographic initialization module URL. |
| URL | hxxps[:]//utaq[.]cfww[.]shop/f6377d5d458183d41c5fd99661c5a306b42c6255[.]js | Remote non-Safari WebKit cryptographic getter module URL. |
| URL | hxxps[:]//utaq[.]cfww[.]shop/ff4f3cb4711fb364b52de5ab04a8f83140466f89[.]js | Remote WASM loader URL selected for iOS 15.6–16.1. |
| URL | hxxps[:]//utaq[.]cfww[.]shop/gooll/49554fde7424c31c[.]js | Exploit qualification and delivery framework entry-point URL. |
| URL | hxxps[:]//utaq[.]cfww[.]shop/gooll/gooll[.]html | Watering-hole landing page embedding the implant. |
| URL | hxxps[:]//v3[.]jiathis[.]com/code/art[.]js | Remote script injected by compromised art-template 4.13.6. |
| URL | hxxps[:]//v3[.]jiathis[.]com/code/jia[.]js?uid=artemplate | Remote script injected by compromised art-template 4.13.5. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe implant concealed strings and constants using UTF-16 integer packing, base64 module bodies, per-string XOR encoding, and XOR integer pairs.T1059.007 · JavaScriptThe injected browser JavaScript executed decoded and remotely fetched module bodies through new Function().T1071.001 · Web ProtocolsAn independent beacon loop sent HTTPS POST requests containing the victim's public IP, device version, and tracking code to C2 every ten seconds.T1082 · System Information DiscoveryThe framework inspected user-agent and platform information, scored iOS versions, and probed CPU architecture to select device-specific modules.T1105 · Ingress Tool TransferThe content-addressed loader retrieved additional JavaScript modules from the watering-hole origin using XHR and evaluated their contents.T1140 · Deobfuscate/Decode Files or InformationThe implant recovered packed strings at runtime, decoded base64 with atob(), and decoded XOR-encoded character arrays before evaluating modules.T1189 · Drive-by CompromiseDownstream websites consuming the compromised browser build silently loaded a watering-hole exploit delivery framework in visitors' browsers.T1195.001 · Compromise Software Dependencies and Development ToolsThe actor took control of art-template and published compromised dependency versions containing browser-side remote-script loaders.T1497.001 · System ChecksThe framework rejected webdriver-controlled browsers and checked WebRTC, WebGL, MathML rendering, storage behavior, and genuine WebAssembly runtime characteristics.
CVE
CVE-2021-30952iOS 11.0–15.1 (mmrZ0r) — Coruna buffout (CVE-2021-30952, fixed 15.2) and jacurutu (CVE-2022-48503, fixed 15.6)CVE-2022-48503iOS 11.0–15.1 (mmrZ0r) — Coruna buffout (CVE-2021-30952, fixed 15.2) and jacurutu (CVE-2022-48503, fixed 15.6)CVE-2023-43000iOS 16.2–16.5 (KeCRDQ) — Coruna terrorbird (CVE-2023-43000, fixed 16.6)CVE-2024-23222iOS 16.6–17.2 (JtEUci) — Coruna cassowary (CVE-2024-23222, fixed 17.3)
People
Threat Actors
Malware
IronLoaderCoruna dispatches chip-specific exploit modules: IronLoader targets ≤A12 chips and NeuronLoader targets A13–A16 chips, both operating at the sandbox escape layer. Our sample discriminates identically at the WASM layer,NeuronLoaderCoruna dispatches chip-specific exploit modules: IronLoader targets ≤A12 chips and NeuronLoader targets A13–A16 chips, both operating at the sandbox escape layer. Our sample discriminates identically at the WASM layer,PLASMAGRIDThe PlasmaLoader binary payload (PLASMAGRID, com.apple.assistd)PlasmaLoaderThe PlasmaLoader binary payload (PLASMAGRID, com.apple.assistd)
Products
art-templateThe art-template npm package, a widely-used JavaScript templating library originally authored by aui, was handed over to an unknown actor under the pretense of taking on maintenance of a project the original author wasiOSdetected signals of a package compromise leading to a sophisticated payload targeting a broad range of iOS devices with a watering-hole attack similar in style to the delivery of the Coruna exploit kit. AftermacOSmacOS Safari — partial; desktop WebKit path exists, fingerprinting differsSafariimplant (49554fde7424c31c.js ) functions as a watering hole exploit delivery framework, targeting Safari on iOS 11.0 through iOS 17.2, explicitly and intentionally rejecting every other browser, OS, and iOS
Tools
bluebirdiOS 15.6–16.1 (ShQCsB) — Coruna bluebird (no CVE, fixed 16.2)breezyPAC bypass modules (breezy, seedbell family)buffoutiOS 11.0–15.1 (mmrZ0r) — Coruna buffout (CVE-2021-30952, fixed 15.2) and jacurutu (CVE-2022-48503, fixed 15.6)cassowaryiOS 16.6–17.2 (JtEUci) — Coruna cassowary (CVE-2024-23222, fixed 17.3)Corunaa broad range of iOS devices with a watering-hole attack similar in style to the delivery of the Coruna exploit kit. After careful analysis, a plethora of similarities to that campaign emerged, indicating thatGruberPrivilege escalation and PPL bypass chains (Photon, Gruber, Sparrow, etc.)jacurutuiOS 11.0–15.1 (mmrZ0r) — Coruna buffout (CVE-2021-30952, fixed 15.2) and jacurutu (CVE-2022-48503, fixed 15.6)PhotonPrivilege escalation and PPL bypass chains (Photon, Gruber, Sparrow, etc.)seedbellPAC bypass modules (breezy, seedbell family)SparrowPrivilege escalation and PPL bypass chains (Photon, Gruber, Sparrow, etc.)terrorbirdiOS 16.2–16.5 (KeCRDQ) — Coruna terrorbird (CVE-2023-43000, fixed 16.6)