Coruna, DarkSword iOS Exploits Proliferate Globally

Apple's iOS platform is facing significant threats as nation-state-grade exploit kits Coruna and DarkSword are increasingly exploited by cybercriminals globally. Researchers have identified roughly 17,000 domains distributing modified versions of these tools, which target specific vulnerabilities including CVE-2025-31277, CVE-2025-43529, and CVE-2026-20700 in recent iterations. While DarkSword affects iOS 18.4 through 18.7 and Coruna targets iOS 13 through 17.2.1, threat actors are now combining techniques from both frameworks into hybrid variants known as "Darkuna" to enhance stealth and persistence. The shift toward criminal usage introduces capabilities for cryptocurrency theft and mass device compromise, marking a critical escalation in the sophistication of attacks against mobile devices.