Dating and AI-Companion Lures Load iPhone Exploit Chains in Safari

Dating sites, AI-companion apps and crypto casinos are being used to push iPhone users into Safari, where hidden pages quietly try to take over the phone, Zimperium says in new research. The pages load one of two exploit chains: Coruna, a nation-state iOS toolkit that later leaked and is now sold on, and a DarkSword-derived chain for iOS 18. On a test iPhone running iOS 18.6.2, Zimperium watched the chain steal the Apple Notes database and a list of 214 installed apps.

ccsigen321qc[.]com (DarkSword C2)
ssc[.]vever3eds[.]com (staging)
vrgrt4t33[.]com (telemetry)
melatibiru[.]win (delivery)
a111[.]life (loader)
ajax[.]googleapls[.]com (typosquat)
5.255.61[.]234

globalThis.obChTK
rce_loader.js
group.html
guard.html
Campaign IDs: 1DECX7UIQIB95, k7Xp3Rm9Qz

Source article: Inside Coruna and DarkSword Chains: From Web Lures to iOS Exploitation
Publisher: Zimperium zLabs (Santiago Rodriguez)
Published: October 29, 2026
URL: https://zimperium.com/blog/inside-coruna-and-darksword-chains-from-web-lures-to-ios-exploitation

Executive Summary

Coruna is an iOS exploit framework first analyzed by Google Threat Intelligence Group, which Zimperium describes as originally developed by a nation-state actor and later leaked, commoditizing it for commercial surveillance customers, state-sponsored groups and financially motivated actors; DarkSword is a separate iOS 18 execution chain that Zimperium finds sharing staging infrastructure with Coruna. Zimperium names no operator and scopes attribution to code and infrastructure, noting that Chinese-language code comments do not establish identity. Delivery runs through dating, AI-companion, crypto-casino, streaming, forum and comic lures, with dating lures seen in Brazil, Nigeria and Indonesia, and through supply-chain injection via a compromised npm package and a typosquatted jquery.min.js on ajax[.]googleapls[.]com. A lure pushes the visitor into Safari, a hidden iframe loads the loader, the loader fingerprints Mobile Safari and the iOS version, and routes iOS 15 to 17.1.x to the Coruna chain (group.html) and iOS 18.4 to 18.7.2 to the DarkSword chain (rce_loader.js). Coruna begins with CVE-2022-48503 in Safari’s WebAssembly engine; DarkSword escapes through the GPU process into mediaplaybackd; both end in a native implant set with kernel, orchestration and log-wiping modules that beacons to the C2 over HTTPS with ChaCha20 and deletes crash, Jetsam and Safari data. On an iOS 18.6.2 test device the chain exfiltrated NoteStore.sqlite and a 214-app inventory, and a module targets Telegram authentication material. The objective is surveillance and data theft from iPhones running outdated iOS. Hunt leads, false positive expectations and indicators are detailed below; the source publishes no detection rules.

ATT&CK chain: Resource Development → Initial Access → Execution → Privilege Escalation → Defense Evasion → Discovery → Collection → Command and Control → Exfiltration

Hunt Lead Grid

Coruna and DarkSword Infrastructure Sweep

Zimperium names the DarkSword C2 ccsigen321qc[.]com, the staging host ssc[.]vever3eds[.]com shared by both chains (serving /static/js/vendor/base.min.html), the telemetry collector vrgrt4t33[.]com/log.html reached over HTTP/3, the delivery domain melatibiru[.]win, the loader host a111[.]life (guard.html), the typosquat ajax[.]googleapls[.]com, lure domains including echomint[.]buzz, ax[.]xoovo[.]top, www2[.]disp[.]cc, xxtg1[.]eu[.]cc, 3x3br[.]eu[.]cc, 66wc[.]eu[.]cc, toongod[.]us and jiaoyou[.]eu[.]cc, adult portals kjkp[.]com[.]cn and qcsh[.]com[.]cn, and the IP 5.255.61[.]234, which passive DNS links to dating lures. It also lists commoditytrendpilot[.]site and stocktrendpilot[.]net from certificate co-listing, explicitly as leads rather than confirmed indicators. The detection logic is a retrospective search of DNS, proxy, TLS SNI and firewall logs for these hosts, with particular weight on any device that touched the C2 or telemetry host, since those are reached only after the loader runs.

Use DNS resolver, secure web gateway and mobile threat defense network logs, and include traffic from managed iPhones on VPN or per-app VPN where available; personal devices on guest Wi-Fi often show up only in DNS. Pull the full 93-domain list from Zimperium’s IOC repository. Sweep 90 days, since the lure network predates the write-up. HTTP/3 to the telemetry host travels over UDP 443 and is invisible to proxies that only inspect TCP, so check firewall and DNS logs for it. Do not treat the certificate co-listed domains as confirmed; enrich them first. A lure-domain hit alone shows exposure; a C2 or telemetry hit from an iPhone running a targeted iOS version should be treated as a probable compromise and the device pulled for forensic review.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Initial Access → T1189 (Drive-by Compromise); Command and Control → T1071.001 (Application Layer Protocol: Web Protocols) (Zimperium maps the activity to ATT&CK for Mobile; Enterprise equivalents are used here)

Sources: “Inside Coruna and DarkSword Chains: From Web Lures to iOS Exploitation”, Zimperium, Oct. 29, 2026, https://zimperium.com/blog/inside-coruna-and-darksword-chains-from-web-lures-to-ios-exploitation (source article); Zimperium IOC repository, https://github.com/Zimperium/IOC/tree/master/2026-10-CorunaDarkSword (source article’s linked IOC set)

Loader Markers in Served Web Content

The loader reached victims both from attacker-run lure sites and from legitimate sites that pulled in injected code, through a compromised art-template npm package and through a fake jquery.min.js on ajax[.]googleapls[.]com that loads an iframe to a111[.]life/guard.html. Zimperium recommends hunting on stable code markers rather than lure content: the JavaScript namespace globalThis.obChTK, the loader identifier cecd08aa6ff548c2, a 29,924-byte decoded runtime that was identical across sites, the campaign IDs 1DECX7UIQIB95 and k7Xp3Rm9Qz, and file names including rce_loader.js, group.html, guard.html, pe_worker.js and c2_agent.js. The detection logic is a content search of your own websites’ served HTML and bundled JavaScript, your build artifacts and lockfiles, and any captured web content, for those markers and for references to the typosquatted CDN host.

Use web content scanning of your own properties, software composition analysis over package lockfiles, CI build logs and secure web gateway content inspection where bodies are retained. Sweep your dependency history back to May 2026, when the npm compromise was reported. File names alone are too generic, so require the namespace, a campaign ID or the typosquat host. Removing the iframe from one page is the wrong fix if the dependency stays in the lockfile; pin and replace the package and rebuild. A marker found in your own site means you have been serving an exploit loader to visitors: take the page down, notify users and escalate.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Initial Access → T1195.001 (Supply Chain Compromise: Compromise Software Dependencies and Development Tools); Execution → T1059.007 (Command and Scripting Interpreter: JavaScript)

Sources: “Inside Coruna and DarkSword Chains: From Web Lures to iOS Exploitation”, Zimperium, Oct. 29, 2026, https://zimperium.com/blog/inside-coruna-and-darksword-chains-from-web-lures-to-ios-exploitation (source article)

Implant Check-In Paths From Mobile Devices

During the iOS 18.6.2 run Zimperium counted 144 HTTPS POSTs to the C2: module requests to /api/payload/get, 14 check-ins to /beacon and 11 task requests to /api/task/pull, with the Notes database and app inventory sent from SpringBoard and acknowledged. A separate tracking beacon fired every ten seconds carrying the public IP, iOS version, a campaign ID and a domain value, and the browser stage sent execution telemetry to log.html. The implant’s HTTPS client disables certificate-chain validation and wraps commands in ChaCha20. The detection logic is a proxy or DNS-plus-flow rule for iOS devices making repeated POSTs to /beacon, /api/task/pull or /api/payload/get on uncategorized or recently registered domains, plus a periodicity check for ten-second beaconing from a single device.

Use secure web gateway logs with TLS inspection where policy allows, or mobile threat defense network telemetry; without inspection, fall back to SNI plus flow timing. Scope to iOS user agents and managed iPhones. Sweep 30 to 90 days. Allowlist legitimate app back-ends by hostname, not path. Blocking only the known C2 domain is a weak control since collectors rotate across 21 hosts; keep the path and cadence rule live. Large POSTs following module downloads suggest data theft has already happened, so any hit should go to incident response, with the device isolated and its sysdiagnose and crash logs preserved before the implant’s log wiping runs again.

Hunt Lead Level: 2 (Pro)

ATT&CK: Command and Control → T1071.001 (Application Layer Protocol: Web Protocols), T1573.001 (Encrypted Channel: Symmetric Cryptography); Exfiltration → T1041 (Exfiltration Over C2 Channel)

Sources: “Inside Coruna and DarkSword Chains: From Web Lures to iOS Exploitation”, Zimperium, Oct. 29, 2026, https://zimperium.com/blog/inside-coruna-and-darksword-chains-from-web-lures-to-ios-exploitation (source article)

Outdated iOS Plus Lure Visit Correlation

The chains only work on specific iOS ranges: 15.x, 16.x except 16.7.x, and 17.0 to 17.1.x for Coruna, and 18.4 to 18.7.2 for DarkSword. After exploitation the implant deletes WebKit diagnostic reports, JetsamEvent records and launchd.log, and clears Safari website data, and Zimperium flags crashes or restarts in mediaplaybackd, the GPU process and SpringBoard, plus unexpected changes to code-signing state, as integrity signals. The detection logic joins three sources per device: MDM inventory showing an iOS build inside a targeted range, a proxy or DNS hit on a lure, loader or staging domain, and any device anomaly afterwards, such as missing or truncated diagnostic logs, crash reports from those processes, or a mobile threat defense integrity alert.

Join MDM device inventory, DNS and proxy logs, and mobile threat defense alerts in a SIEM, keyed on device ID and user. Sweep 90 days. Expect noise from people who visit dating or streaming sites on patched phones, which is why the iOS version filter comes first; a patched device with a lure visit is exposure, not compromise. Waiting for the user to report symptoms is the wrong approach because the implant deliberately removes evidence; capture a sysdiagnose as soon as the correlation fires. The best control is enforcing a minimum iOS version through conditional access, with Lockdown Mode for high-risk staff. A device in a targeted range with a staging, C2 or telemetry hit plus a log gap or process anomaly should be treated as compromised and escalated for forensic analysis.

Hunt Lead Level: 3 (Elite)

ATT&CK: Initial Access → T1189 (Drive-by Compromise); Defense Evasion → T1070 (Indicator Removal)

Sources: “Inside Coruna and DarkSword Chains: From Web Lures to iOS Exploitation”, Zimperium, Oct. 29, 2026, https://zimperium.com/blog/inside-coruna-and-darksword-chains-from-web-lures-to-ios-exploitation (source article)

Hash Appendix

Coruna and DarkSword native payloads

The source article publishes no full MD5, SHA-1 or SHA-256 values; it gives only a 16-character loader identifier, cecd08aa6ff548c2, which is not a standard file hash and should be used as a string marker. Zimperium says the hashes for the native Mach-O binaries are in its IOC repository (https://github.com/Zimperium/IOC/tree/master/2026-10-CorunaDarkSword). AlienVault OTX and VirusTotal were not queried in this run.

MD5s
(not available)  # Coruna/DarkSword native Mach-O payloads (see Zimperium IOC repository)

SHA1s
(not available)  # Coruna/DarkSword native Mach-O payloads (see Zimperium IOC repository)

SHA256s
(not available)  # Coruna/DarkSword native Mach-O payloads (see Zimperium IOC repository)

References Appendix

• “Inside Coruna and DarkSword Chains: From Web Lures to iOS Exploitation”, Zimperium, Oct. 29, 2026, https://zimperium.com/blog/inside-coruna-and-darksword-chains-from-web-lures-to-ios-exploitation (source article; delivery chain, targeted versions, infrastructure, C2 behavior, recommendations)
• Zimperium IOC repository, 2026-10-CorunaDarkSword, https://github.com/Zimperium/IOC/tree/master/2026-10-CorunaDarkSword (full IOC set linked from the source article)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/