SafeDep

Coruna and DarkSword iPhone exploit kits spread via 608 web domains and a backdoored npm package

Zimperium zLabs documented 608 domains delivering Coruna✱-family code, which selects an exploit chain by iOS version: Coruna for iOS 17.2.1 or older and a DarkSword✱-based chain for iOS 18. Delivery is through decoy lure sites with hidden frames, a backdoored art-template npm package reported by SafeDep◼, and a fake jquery.min.js loaded from a look-alike Google domain. The malware steals data such as Telegram storage and the Apple Notes database, and deletes crash logs and Safari data to hide its tracks. Every CVE in the chains is already patched.