Coruna and DarkSword iPhone exploit kits spread via 608 web domains and a backdoored npm package
THREAT ACTORCVE-2022-48503redteam/daily · 1 source
- Severity
- High
- Exploited
- Yes
- Sources
- 1
What happened
Zimperium zLabs documented 608 domains delivering Coruna-family code, which selects an exploit chain by iOS version: Coruna for iOS 17.2.1 or older and a DarkSword-based chain for iOS 18. Delivery is through decoy lure sites with hidden frames, a backdoored art-template npm package reported by SafeDep, and a fake jquery.min.js loaded from a look-alike Google domain. The malware steals data such as Telegram storage and the Apple Notes database, and deletes crash logs and Safari data to hide its tracks. Every CVE in the chains is already patched.
For IT people · Written by AI from 1 source · Wrong?
What to do
- CVE-2022-48503 is being exploited: treat it as urgent.
- CISA’s required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Check whether you use Apple Multiple Products: add it to your watchlist to hear when it is affected. Open your watchlist
Based on advisory data
Vulnerabilities
Full story timeline · 2 updates
Who reported · 1 outlet
Cyber Security News