Criminals are increasingly leveraging leaked exploit kits to compromise iPhones, creating significant security risks for corporate environments where employees use personal devices for work. According to the 2026 Advanced Mobile Threat Report from iVerify, two specific toolkits, DarkSword and Coruna, are being deployed through malicious advertisements and compromised websites to target iOS users. While DarkSword was initially disclosed by researchers in March 2026, a version of the code appeared on GitHub shortly thereafter, allowing criminal groups to adapt and weaponize the exploit chain.
The infection process often begins with minimal user interaction. In one documented instance, a variant of DarkSword successfully infected an iPhone simply by loading an advertisement while the user was scrolling through Instagram. Another attack vector involves traffic-selling operations such as DeadTag, which repurposes expired domains previously used by e-commerce platforms. Because some websites still reference these old domains in their templates, browsers automatically fetch scripts controlled by the new owners, who then redirect visitors to malicious sites.
These malicious sites are designed to identify the target's operating system. For example, one hidden page associated with the DeadTag network specifically checks for Safari on iOS versions 18.4.0 through 18.7.2. If a match is found, the site initiates the DarkSword exploit chain. Researchers have observed thousands of websites loading code from more than 660 re-registered domains, with estimates suggesting these sites receive approximately 135 million visits every month.
The primary objective of these campaigns appears to be the theft of cryptocurrency and sensitive credentials. Coruna payloads have been observed scanning devices for text and images containing recovery phrases for digital wallets. DarkSword, meanwhile, is capable of extracting passwords and sign-in information directly from the iPhone’s Keychain. This capability poses a severe threat to organizations, as stolen session tokens or credentials can allow attackers to bypass security measures and gain unauthorized access to corporate networks under the guise of legitimate user activity.
Data suggests that these threats are not limited to high-profile targets. Every enterprise-level detection of DarkSword or Coruna identified in the report involved employees at or below the managing-director level. Furthermore, iVerify estimates that roughly one in every 900 consumer iOS devices shows signs of spyware, with three-quarters of these detections linked to actors seeking credentials or cryptocurrency.
A significant challenge for investigators is the ephemeral nature of these infections. Traces of the DarkSword malware often persist on a device for only a short duration. Routine actions such as a device reboot or a standard software update can effectively remove the malicious code and erase the forensic evidence necessary to reconstruct the attack.
Despite the severity of these exploits, the affected party has not confirmed the issuance of Apple threat notifications for the devices identified by researchers. These alerts are typically reserved for individuals Apple believes have been targeted by mercenary spyware, suggesting that the current wave of automated, mass-market exploit kit attacks may fall outside the scope of the company's current notification criteria.
The combination of leaked, adaptable exploit code and automated traffic-brokering networks has lowered the barrier to entry for cybercriminals. By exploiting the intersection of personal device usage and corporate access, these groups are turning everyday browsing habits into potential entry points for large-scale data breaches. As these toolkits continue to circulate, the risk to enterprise security remains high, particularly as the malware leaves behind few indicators of compromise for security teams to detect.
