Coruna and DarkSword iPhone exploit kits spread via 608 web domains and a backdoored npm package
- Severity
- High
- Exploited
- Yes
- Sources
- 1
What happened
Zimperium's report (published 29 October 2026) describes Coruna using CVE-2022-48503, a Safari WebAssembly flaw, followed by a pointer authentication bypass, kernel memory read/write and code-signing changes. The DarkSword chain runs browser code, escapes via the GPU process into mediaplaybackd, and in testing on iOS 18.6.2 made 144 command-server contacts and fetched seven modules. Domain blocklists miss the supply chain route via the backdoored art-template npm package, so defenders should also audit third-party scripts and enforce a strict Content Security Policy. Require patched iOS builds on all devices (Apple extended iOS 18.7.7 to more devices), enable Lockdown Mode for high-risk users, deploy mobile threat defence, and retain diagnostic logs because the malware wipes local traces. Attribution is unclear; Chinese-language code comments do not establish who deployed it.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- CVE-2022-48503 is being exploited: treat it as urgent.
- CISA’s required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Check whether you use Apple Multiple Products: add it to your watchlist to hear when it is affected. Open your watchlist
Based on advisory data