DarkSword
Linked
Latest
Russian APT29 hackers use trusted websites to hack outdated iPhones and Android phones
Researchers at Sekoia attribute a campaign with moderate to high confidence to APT29, which used compromised sites, lookalike domains and a hacked Ukrainian SEO tracker to deliver device-specific exploits. The loaded script, UltimateFingerprinter, selects iOS 16.7, iOS 18.5 or Android Chrome targets, and the payloads steal cookies, saved logins, messages and other data without setting up lasting access. Fully patched iOS and Chrome versions are reported as safe, so the main defence is updating devices and replacing those no longer receiving updates.
Coruna and DarkSword iPhone exploit kits spread via 608 web domains and a backdoored npm package
Zimperium zLabs documented 608 domains delivering Coruna-family code, which selects an exploit chain by iOS version: Coruna for iOS 17.2.1 or older and a DarkSword-based chain for iOS 18. Delivery is through decoy lure sites with hidden frames, a backdoored art-template npm package reported by SafeDep, and a fake jquery.min.js loaded from a look-alike Google domain. The malware steals data such as Telegram storage and the Apple Notes database, and deletes crash logs and Safari data to hide its tracks. Every CVE in the chains is already patched.