Apple Warns Users of Outdated iPhones About Web-Based Exploit Attacks
Summary
Apple is sending Lock Screen alerts urging users of older iOS and iPadOS devices to update. The warning follows reports on the Coruna and DarkSword exploit kits, which target specific iOS versions through compromised websites.
Key points
- Apple’s Lock Screen notifications urge users of outdated iPhones and iPads to install a critical update.
- The article says Coruna targets iOS 13.0–17.2.1, while DarkSword targets iOS 18.4–18.7.
- Multiple threat actors have reportedly used the kits to deliver malicious payloads through compromised websites.
- Kaspersky describes Coruna as an evolution of the framework used in Operation Triangulation.
- The article says how the kits reached multiple threat actors is unknown; research has raised the possibility of a market for second-hand zero-day exploits.
- Users unable to update are advised to consider enabling Lockdown Mode. Apple says it is not aware of successful mercenary spyware attacks against devices with the mode enabled.
Article Details
- Event Type
- Apple security notifications warning users of outdated iOS and iPadOS about web-based attacks and urging them to install updates.
- Impact
- Multiple threat actors have reportedly used the Coruna and DarkSword exploit kits to deliver malicious payloads through compromised websites. Coruna targets iOS 13.0–17.2.1, and DarkSword targets iOS 18.4–18.7. The article does not report successful attacks against devices with Lockdown Mode enabled; Apple said it was not aware of any successful mercenary spyware attacks against such devices.
Vendors
Products
iOSApple is sending Lock Screen notifications to iPhones and iPads running older iOS and iPadOS to warn users of web-based attacks and urge installation of a critical update.iPadOSApple is sending Lock Screen notifications to iPhones and iPads running older iOS and iPadOS to warn users of web-based attacks and urge installation of a critical update.iPhone“Apple is aware of attacks targeting out-of-date iOS software, including the version on your iPhone.Lockdown Modethreat actors to deliver malicious payloads via compromised websites—and advise updating or enabling Lockdown Mode if upgrades are not possible.
Tools
CorunaThe alerts follow disclosures about exploit kits Coruna and DarkSword—used by multiple threat actors to deliver malicious payloads via compromised websites—and advise updating or enabling Lockdown Mode if upgrades areDarkSwordThe alerts follow disclosures about exploit kits Coruna and DarkSword—used by multiple threat actors to deliver malicious payloads via compromised websites—and advise updating or enabling Lockdown Mode if upgrades are