Lockdown Mode
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Security timeline
- Malware reported by Cyber Security NewsApple sends new mercenary spyware threat notifications to iPhone users in 99 countries
- Activity reported by CyberScoopApple warns users in 99 countries of mercenary spyware attacks, over 150 countries notified to date
- Activity reported by Cyber Security NewsCoruna and DarkSword iPhone exploit kits spread via 608 web domains and a backdoored npm package
Recent news
Apple sends new mercenary spyware threat notifications to iPhone users in 99 countries
Apple has issued a new wave of threat notifications to selected iPhone users in 99 countries, reported by researcher Costin Raiu on 30 October 2026 and separate from the August alerts that covered 110 countries. Apple says more than 150 countries have been notified in total, but these figures refer to user locations, not confirmed infections. Apple has not named the attackers, the spyware product or any software flaw involved.
Apple warns users in 99 countries of mercenary spyware attacks, over 150 countries notified to date
Apple issued a new round of threat notifications to targeted users in 99 countries, bringing its total to over 150 countries. Apple does not attribute the attacks to any specific attackers or regions. Citizen Lab and Access Now advise recipients to enable Lockdown Mode and contact Access Now, and warn that the absence of a notification does not rule out infection. The previous major batch was sent in August, and the latest one comes shortly before final negotiations on industry standards under the voluntary Pall Mall Process.
Coruna and DarkSword iPhone exploit kits spread via 608 web domains and a backdoored npm package
Zimperium zLabs documented 608 domains delivering Coruna-family code, which selects an exploit chain by iOS version: Coruna for iOS 17.2.1 or older and a DarkSword-based chain for iOS 18. Delivery is through decoy lure sites with hidden frames, a backdoored art-template npm package reported by SafeDep, and a fake jquery.min.js loaded from a look-alike Google domain. The malware steals data such as Telegram storage and the Apple Notes database, and deletes crash logs and Safari data to hide its tracks. Every CVE in the chains is already patched.