{"id":30261,"date":"2026-04-17T14:20:08","date_gmt":"2026-04-17T13:20:08","guid":{"rendered":"https:\/\/www.kaspersky.co.uk\/blog\/?p=30261"},"modified":"2026-04-17T14:20:08","modified_gmt":"2026-04-17T13:20:08","slug":"ios-exploits-darksword-and-coruna-in-mass-attacks","status":"publish","type":"post","link":"https:\/\/www.kaspersky.co.uk\/blog\/ios-exploits-darksword-and-coruna-in-mass-attacks\/30261\/","title":{"rendered":"The iPhone \u2014 invincible no more: a look at DarkSword and Coruna"},"content":{"rendered":"

DarkSword and Coruna are two new tools for invisible attacks on iOS devices. These attacks require no user interaction and are already being actively used by bad actors in the wild. Before these threats emerged, most iPhone users didn\u2019t have to lose sleep over their data security. Protection was really only a major concern for a narrow group \u2014 politicians, activists, diplomats, high-level business execs, and others who handle extremely sensitive data \u2014 who might be targeted by foreign intelligence agencies. We\u2019ve covered sophisticated spyware<\/a> used against such a group before \u2014 noting how hard to come by those tools were.<\/p>\n

However, DarkSword and Coruna \u2014 discovered by researchers earlier this year \u2014 are total game-changers. This malware is being used for mass infections of everyday users. In this post, we dive into why this shift happened, why these tools are so dangerous, and how you can stay protected.<\/p>\n

What we know about DarkSword, and how it can target your iPhone<\/h2>\n

In mid-March 2026, three separate research teams coordinated the release of their findings on a new spyware strain<\/a> called DarkSword. This tool is capable of silently hacking devices running iOS 18 without the user ever knowing something is wrong.<\/p>\n

First, we should clear up some confusion: iOS 18 isn\u2019t as vintage as it might sound. Even though the latest version is iOS 26<\/a>, Apple recently overhauled its versioning system, which threw everyone for a loop. They decided to jump ahead eight versions \u2014 from 18 straight to 26 \u2014 so the OS number matches the current year. Despite the jump, Apple estimates that about a quarter of all active devices still run iOS 18 or older<\/a>.<\/p>\n

With that cleared up, let\u2019s get back to DarkSword. Research shows that this malware infects victims when they visit perfectly legitimate websites that have been injected with malicious code. The spyware installs itself without any user interaction at all: you just have to land on a compromised page. This is what\u2019s known as a zero-click infection technique. Researchers report that several thousand devices have already been hit this way.<\/p>\n

To compromise a device, DarkSword uses a six-vulnerability exploit chain to escape the sandbox, escalate privileges, and execute code. Once it\u2019s in, the malware harvests data from the infected device, including:<\/p>\n