From targeted tool to public code: how an iPhone exploit kit leaked

Two kits, close together

On 3 March 2026 Google’s Threat Intelligence Group documented Coruna, a JavaScript-delivered kit with 23 exploits in five chains that covers iPhones running iOS 13.0 to 17.2.1[S1]. Two weeks later, on 18 March, Google, Lookout and iVerify each published on DarkSword, a chain of six flaws, three of them exploited as zero-days, written entirely in JavaScript and started by a visit to a web page [S2][S3][S4]. Google says several operators had used it since at least November 2025[S2].

Google lists iOS 18.4 through 18.7 as the affected range; Lookout cites a narrower range of 18.4 to 18.6.2. Both agree that iOS 18.7.3 and later, and iOS 26.3 and later, fall outside the chain [S2][S3]. Apple’s notes show the two web-engine fixes arriving in iOS 26.2 on 12 December 2025 and the third, in the dynamic linker, in iOS 26.3 on 11 February 2026 [S9][S10].

What the kits take explains why the proliferation matters. Google lists the data DarkSword’s implants steal as messages from iMessage, WhatsApp and Telegram, keychain contents, account data, location history, Safari data, notes, photos and cryptocurrency wallet data[S2]. Coruna’s final stage, in the campaign Google describes, targets wallets rather than classic espionage[S1]. Google traced Coruna’s path through 2025 from a customer of a commercial surveillance vendor, to a suspected espionage cluster using compromised sites, to a financially motivated group using fake finance and crypto sites[S1]. Those are Google’s assessments and tracking labels. We name no state and no company.

Apple also issued an emergency update on 11 March for devices that cannot run recent iOS, according to TechCrunch’s report of Apple’s statement[S5].

The leak

On 23 March TechCrunch reported that a newer build of DarkSword had been posted on a public code-hosting site. An iVerify co-founder told the outlet it is plain HTML and JavaScript that anyone can host and that needs no iOS expertise, and a Google spokesperson agreed[S5]. The report also relayed an anecdote that a hobbyist used it on an old tablet; we treat that as unverified.

We do not link to the code or describe how to find it, and we do not know whether it remains available. We also do not know who posted it. No source we reviewed says.

What iVerify says since

Each item below is iVerify’s statement[S7][S8], and we have found no independent confirmation of any of them.

On 15 September iVerify said Coruna and DarkSword are now used together, a pairing it nicknames "DarkCoruna" (it called it "Darkuna" in March press, and both are its labels, not industry terms). It said DarkSword’s source code was leaked by a third party and has spawned variants, and that some attempts to extend it to iOS 26 look unsuccessful and possibly written with AI help[S7].

On 8 October iVerify described a variant it found during an August examination of a customer’s phone. It says the variant logs less, injects fewer processes, checks in with its server every 15 seconds and steals keychain contents, notes, photos, an app inventory and one wallet app’s data. The firm names no actor, flaw list or delivery method[S8].

The estimates we do not chart

iVerify has also cited figures for the devices on vulnerable versions, the domains hosting later iterations, and a rise in attacks on vulnerable versions between August and September. None comes with a stated denominator, and none has been checked by anyone else, so we chart none of them [S4][S7]. iVerify is a mobile security vendor with a commercial interest in these numbers. That is not an accusation. It is a reason for care.

Our assessment: lower cost, same ceiling

A public kit lowers the price of trying. Anyone who can host a page can attempt the chain, which widens the set of possible users beyond the original operators. But the chain still needs a phone it fits. Per Google and Lookout, a phone on iOS 26.3 or later, or on the 18.7.3 and later backports, is outside it [S2][S3].

TechCrunch’s analysis on 26 March, which is one outlet’s view with named experts, says phones on iOS 26 and iPhones with newer memory protections are far harder to exploit, while phones on iOS 18 or older remain exposed to leaked and resold chains. iVerify’s quoted view was that zero-days against current software stay expensive and unlikely to be used broadly; Lookout’s was that a second-hand exploit market will recur[S6]. Apple told TechCrunch that Lockdown Mode blocks these attacks[S5], and on 27 March said it is not aware of a successful mercenary spyware attack against a device with Lockdown Mode enabled[S11]. That is Apple’s statement of what it knows, not a guarantee.

What defenders can do

The simplest control is the oldest. For phones that cannot move to iOS 26, Apple’s release index lists an iOS 18 backport track that ran as far as iOS 18.7.10 on 17 August 2026, so staying on the newest release for the device’s branch still matters[S12]. The chain is also matched to specific software versions, and Google and Lookout both say phones on the fixed releases fall outside it [S2][S3]. A current phone is not a softer target because the code is public.

What the Lab is watching

We are watching three things.

First, whether Google, Lookout or another independent group confirms any iVerify variant[S2][S3][S7]. Until then the variants are a vendor’s observation, and we label them so.

Second, whether Apple extends fixes to more older devices, because the size of the exposed group depends on it. TechCrunch’s one-in-four estimate describes people who have not moved to iOS 26; some of them cannot [S5][S6].

Third, whether the delivery side, the compromised or lookalike web pages, becomes better documented than the kit itself. A kit is only dangerous when a phone is sent to it. We will date any change.

What this means for examiners

Check each phone’s software version against Apple’s security releases first. For a client with an estate of devices, the older phones matter most: they are the ones a public kit can reach. Ask whether a user visited an unfamiliar or lookalike page in the period of concern. Browser history is clearable and may be thin, so ask for the other records as well. Where a phone cannot be updated, Apple says Lockdown Mode blocks these attacks, and Google describes it as a mitigation where updating is impossible [S2][S5].

What we could not confirm

We could not confirm iVerify’s variant reports[S7][S8], the size of any exposed population, who posted the code, or whether it remains available.