Zimperium Analyzes Coruna and DarkSword iOS Exploit Chains
Summary
Zimperium’s zLabs analyzed Coruna and DarkSword iOS exploit chains, documenting hidden-frame delivery, version-specific exploits, native capabilities and confirmed exfiltration of Notes data and an app inventory from an iOS 18.6.2 test device.
Key points
- Hidden iframes delivered exploit code through decoy pages; a compromised npm art-template package provided another route through legitimate sites, without requiring an app install or user consent.
- The recovered infrastructure selected different chains based on iOS version. The Coruna analysis covers a WebAssembly memory-access exploit, CVE-2022-48503, a pointer-authentication bypass and a native loader.
- Recovered Coruna modules include kernel-memory read/write routines, manipulation of Apple Mobile File Integrity (AMFI) state, process-memory access and routines targeting diagnostic logs and Safari website data for deletion.
- In its analysis of the DarkSword-derived iOS 18 chain, zLabs observed sandbox-pivot attempts involving WebKit’s GPU process and mediaplaybackd, followed by command-and-control traffic.
- On an iOS 18.6.2 test device, zLabs confirmed exfiltration of an Apple Notes database and an inventory of 214 installed applications.
- The researchers identified Coruna-family code across 608 domains; configurations recovered from 93 sites mapped to 21 tracking collectors. Shared code artifacts helped link otherwise different sites and lures.
- The report recommends keeping iOS updated, auditing third-party JavaScript dependencies, using restrictive Content Security Policy rules and preserving diagnostic telemetry.
Article Details
- Attack Vectors
- Lure pages use hidden iframes to load the Coruna or DarkSword exploit chain while visible decoy content appears normal.
- Some lures prompt visitors to leave an in-app browser and open the link in Safari, where the loader performs browser and iOS-version checks.
- Compromised versions of the art-template npm package injected a script that fetched additional code, leading to Coruna delivery through affected sites.
- The Coruna chain uses a WebAssembly flaw to establish browser-memory read/write primitives, then stages a native loader and modules.
- The DarkSword-derived iOS 18 chain moves from the WebContent process through the GPU process and mediaplaybackd before deploying post-exploitation modules.
- The iOS 18 chain retrieves modules, checks in, polls for tasks, and exfiltrates data through its configured C2; the report confirms transfer of an Apple Notes database and an installed-app inventory.
- Defensive Notes
- Keep iOS devices on the latest supported software; the report states that the vulnerabilities mapped to the chain are already patched.
- Audit third-party JavaScript dependencies and use strict Content Security Policy directives to limit permitted script origins.
- Require supported, fully patched iOS builds for devices accessing enterprise assets, including BYOD devices.
- Collect diagnostic logs continuously for high-risk devices because the chain includes routines to delete logs and Safari website data.
- Filter known malicious destinations across both native browsers and in-app web views; do not rely solely on lure-domain or TLD blocklists.
- Treat unsolicited prompts to reopen links in Safari as suspicious, and consider Lockdown Mode for high-risk users on supported, updated devices.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 3x3br[.]eu[.]cc | Lure site whose page directs visitors from TikTok to Safari as part of the exploit-delivery flow. |
| DOMAIN | 66wc[.]eu[.]cc | Domain configuration referencing the same Coruna loader artifact as xxtg1[.]eu[.]cc. |
| DOMAIN | ajax[.]googleapls[.]com | Typosquatted domain impersonating a library CDN; it served a script that created an invisible iframe to initiate the Coruna chain. |
| DOMAIN | ax[.]xoovo[.]top | Attacker-controlled page displaying decoy casino content while loading the exploit in a hidden frame. |
| DOMAIN | ccsigen321qc[.]com | Configured C2 used for module retrieval, check-ins, task polling, and data exfiltration. |
| DOMAIN | echomint[.]buzz | Attacker-controlled lure domain concealing the Coruna exploit framework behind an AI-companion service. |
| DOMAIN | jiaoyou[.]eu[.]cc | Variant domain distributing related Coruna code; the report notes changes to its module-loading routine. |
| DOMAIN | melatibiru[.]win | Site through which zLabs analyzed the DarkSword-derived iOS 18 delivery vector. |
| DOMAIN | ssc[.]vever3eds[.]com | Shared staging host serving loaders for the Coruna and DarkSword-derived chains. |
| DOMAIN | vrgrt4t33[.]com | Destination receiving browser-stage execution telemetry over HTTP/3. |
| DOMAIN | www2[.]disp[.]cc | Page whose HTML places exploit-loading frames off-screen behind forum content. |
| DOMAIN | xxtg1[.]eu[.]cc | Dating lure domain prompting visitors to open the link in Safari and configured to use the Coruna loader. |
MITRE ATT&CK
T1404Coruna native routines access kernel memory and alter AMFI-related state; the DarkSword-derived chain also pivots across sandboxed processes.T1406The recovered Coruna code uses encoded JavaScript, runtime reconstruction, and XOR-decoded strings.T1426The loader reads the iOS version and selects the corresponding exploit route or worker.T1456Lure pages silently load exploit code in hidden iframes while displaying decoy content.T1521.001Recovered native code includes a ChaCha20 implementation; the report says this layer may wrap command traffic.T1630Cleanup routines target WebKit diagnostic reports, JetsamEvent records, launchd.log, and Safari website data for deletion.T1633.001The article's mapping table reports automation, simulator, and virtualization checks in the recovered code.T1660Dating and AI-companion lures, including prompts to reopen links in Safari, socially engineer visitors into the delivery flow.T1664The WebAssembly exploit establishes browser-memory read/write primitives used in the initial exploit stage.