DarkSword iOS exploit chain escapes Safari sandbox on iOS 18, exfiltrates Apple Notes database
Zimperium zLabs reports that the Coruna iOS exploit campaign now delivers two distinct exploit chains, selected by the victim's iOS version: devices on iOS 17.2.1 or earlier get the legacy Coruna framework, while newer builds receive a DarkSword-derived chain. The attack is fully zero-click from the user's perspective — a decoy page renders normally while a hidden iframe loads the exploit, with no app install or prompt. Through October 2026, zLabs counted 608 domains serving Coruna-family code, with configurations from 93 sites mapping to 21 tracking collectors; lures include dating portals, AI-companion apps, crypto promotions and streaming sites, plus compromised legitimate websites. SafeDep additionally found matching Coruna code inside compromised versions of the npm package art-template, meaning a site can serve the kit through its own dependency tree without any lure domain. All CVEs in the chain are already patched, so updating iOS is the primary defense.
Detalhes técnicos
zLabs analyzed the iOS 18 chain via melatibiru[.]win, which pulled ten exploit scripts from the staging host ssc[.]vever3eds[.]com. On iOS 18.6.2 the loader executes rce_worker_18.6.js inside a Web Worker, achieving RCE in the unprivileged WebContent process, then a sandbox escape through WebKit's GPU process (sbx0), a pivot into mediaplaybackd (sbx1), and a post-escape worker managing later payload stages. Both the GPU process and mediaplaybackd attempted to create /private/var/tmp/c2_ipc and were blocked by the sandbox; mediaplaybackd then reached the C2 ccsigen321qc[.]com configured in pe_worker.js. Seven further JavaScript modules were fetched, including c2_agent.js and telegram_v1.js, the latter built to parse local storage and extract authentication material; zLabs recorded 144 HTTPS POSTs to the C2, all answered HTTP 200. The device uploaded the Apple Notes database NoteStore.sqlite and an inventory of 214 installed apps, with the connection initiated by SpringBoard. Native modules use ChaCha20, HTTPS with certificate validation disabled, manipulate AMFI state, and delete crash logs and Safari website data; shared artifacts include a 29,924-byte runtime, the globalThis.obChTK namespace and loader identifier cecd08aa6ff548c2. Across 19 containers researchers extracted 24 binaries, twelve of them version-specific kernel module builds. Google Threat Intelligence Group first documented Coruna in March 2026, describing five exploit chains and 23 exploits covering iOS 13.0 through 17.2.1.
Remediação
Update iOS to the latest build, since every CVE in the chain is patched. Enable Lockdown Mode for high-risk users, enforce OS version policies including BYOD devices, deploy mobile threat defense, and collect diagnostic logs before the malware deletes them. Full indicators are published in Zimperium's IOC repository.
Linha do tempo
-
DarkSword iOS exploit chain escapes Safari sandbox on iOS 18, exfiltrates Apple Notes database
ler a análise desta fonte ocultar
Zimperium zLabs reports that the Coruna iOS exploit campaign now delivers two distinct exploit chains, selected by the victim's iOS version: devices on iOS 17.2.1 or earlier get the legacy Coruna framework, while newer builds receive a DarkSword-derived chain. The attack is fully zero-click from the user's perspective — a decoy page renders normally while a hidden iframe loads the exploit, with no app install or prompt. Through October 2026, zLabs counted 608 domains serving Coruna-family code, with configurations from 93 sites mapping to 21 tracking collectors; lures include dating portals, AI-companion apps, crypto promotions and streaming sites, plus compromised legitimate websites. SafeDep additionally found matching Coruna code inside compromised versions of the npm package art-template, meaning a site can serve the kit through its own dependency tree without any lure domain. All CVEs in the chain are already patched, so updating iOS is the primary defense.
Technical Details
zLabs analyzed the iOS 18 chain via melatibiru[.]win, which pulled ten exploit scripts from the staging host ssc[.]vever3eds[.]com. On iOS 18.6.2 the loader executes rce_worker_18.6.js inside a Web Worker, achieving RCE in the unprivileged WebContent process, then a sandbox escape through WebKit's GPU process (sbx0), a pivot into mediaplaybackd (sbx1), and a post-escape worker managing later payload stages. Both the GPU process and mediaplaybackd attempted to create
/private/var/tmp/c2_ipcand were blocked by the sandbox; mediaplaybackd then reached the C2 ccsigen321qc[.]com configured in pe_worker.js. Seven further JavaScript modules were fetched, including c2_agent.js and telegram_v1.js, the latter built to parse local storage and extract authentication material; zLabs recorded 144 HTTPS POSTs to the C2, all answered HTTP 200. The device uploaded the Apple Notes database NoteStore.sqlite and an inventory of 214 installed apps, with the connection initiated by SpringBoard. Native modules use ChaCha20, HTTPS with certificate validation disabled, manipulate AMFI state, and delete crash logs and Safari website data; shared artifacts include a 29,924-byte runtime, theglobalThis.obChTKnamespace and loader identifiercecd08aa6ff548c2. Across 19 containers researchers extracted 24 binaries, twelve of them version-specific kernel module builds. Google Threat Intelligence Group first documented Coruna in March 2026, describing five exploit chains and 23 exploits covering iOS 13.0 through 17.2.1.Remediation
Update iOS to the latest build, since every CVE in the chain is patched. Enable Lockdown Mode for high-risk users, enforce OS version policies including BYOD devices, deploy mobile threat defense, and collect diagnostic logs before the malware deletes them. Full indicators are published in Zimperium's IOC repository.