HighAPTCVE-2026-31001
DarkSword iOS Exploit Platform Uses Coruna Malware to Steal Crypto Wallet Recovery Phrases
Cyber Security News·Source published ·1 min read
What happened?
DarkSword operators are using Coruna malware to steal cryptocurrency wallet recovery phrases from iPhones, turning browser exploits into a ready-to-use theft service. Exposed server directories revealed wallet modules, command systems, and records of stolen data, giving researchers a closer look at how the platform works beyond its initial exploit chain. A copy of one production server contained 11 victim recovery phrases, 179 device loot directories, and a roster of 75 operator accounts. Those records point to a commercial operation with agents, commissions, and device limits.
Key details
- DarkSword operators use Coruna malware to steal crypto wallet recovery phrases from iPhones.
- Exposed server copy revealed 11 recovery phrases and 179 device loot directories.
- The platform loads three layers: a beacon, a second‑stage controller, and a core implant.
- Implant searches photos and Apple Notes for BIP39 phrases, sending only those that pass checksum.
- Eighteen wallet modules target popular apps such as MetaMask, Phantom, Trust Wallet, Coinbase, Exodus, imToken and Bitpie.
- Control panel supports agent accounts, commissions, device quotas and over 60 commands.
- Logs showed two iPhones checking a beacon every three seconds on September 6, running iOS 16.1 and 16.3.1.
What to look for
- IP 166.88.95[.]90:9999 – operational command server with beacon telemetry.
- C2 URL hxxps://66ds[.]lol observed in 22 wild samples.
- Domain ccwu[.]cc – parent of three panel‑related subdomains.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.