HighAPT
Coruna and DarkSword Exploit Kits Can Fully Compromise iPhones From a Single Web Visit
Cyber Security News·Source published ·1 min read
What happened?
Two powerful iPhone exploit kits, Coruna and DarkSword, show how a visit to a malicious or compromised website can put an outdated device at risk. The kits can link several software flaws together to break out of the browser and reach deeper parts of iOS. Depending on the device’s software version and the kit used, an attacker may then steal sensitive information without needing the user to install an app or tap through extra prompts. These are not ordinary malicious webpages. An exploit kit is a set of tools that checks a visitor’s device and selects code designed for its software.
Key details
- Coruna contains five complete exploit chains and 23 exploits targeting iOS 13.0 through 17.2.1.
- DarkSword uses a six-flaw chain against iOS 18.4 through 18.7.
- Attackers can steal passwords, messages, browsing records, location data and cryptocurrency wallet contents.
- Coruna's final payload PlasmaLoader targets cryptocurrency wallets and searches Apple Notes for recovery phrases.
Fixes and mitigations
- Apple has issued security fixes for older supported devices.
What to look for
- Exploit URL hxxps://cdn[.]gotoiphone[.]com is used for P7 exploit delivery.
- Exploit URL hxxps://mzpo30[.]cam/assets/js/group[.]html is used for P7 exploit delivery.
- C2 server hxxps://agdx53[.]cc is a Command-and-control server.
- SHA-256 c9f8bf92af34239f68e6be9bed945d6e9b4e2d5fc6883a501bc85e3c88a761b7 is rce_loader.js from cdn[.]gotoiphone[.]com.
- SHA-256 eb6da327d5e456a594a066fda2140234ffad305fb204556477718dfce31afe81 is rce_loader.js from mzpo30[.]cam.
- SHA-256 c6587d10462c81c66c0798378710f492c7725a91d86c8e541cf66211bff4abff is c2_agent.js from cdn[.]gotoiphone[.]com.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.