Censys published a report on 7 October 2026 after finding open directories, between 15 and 17 September, on five previously undocumented hosts used to deliver, stage and control the DarkSword iOS exploit chain and Coruna implants. DarkSword gets in through WebKit and JavaScriptCore browser exploits, escapes the Safari sandbox, gains kernel access and reaches SpringBoard, the process that runs the home screen and app launches.

Coruna's core implant then watches for wallet apps to open and injects one of 18 matching modules, covering apps such as MetaMask, Phantom, Trust Wallet, Coinbase, Exodus, imToken and Bitpie. It also searches Photos and Apple Notes for BIP39 recovery phrases, sending only checksum-valid ones, and takes the address book. A copy of one production server held 11 victim recovery phrases, 179 device data folders and 75 operator accounts, and the admin panel supports agents, commissions and device quotas, which points to a theft service sold to others; Censys stresses this does not prove 179 victims.

The 18.x chains are patched in iOS 18.7.3 and iOS 26.3. Censys also found unfinished development work on an iOS 26 chain built around a JavaScriptCore bug it tracks as CVE-2026-31001; it is not deployed, and Censys does not call it a zero-day.

Censys published detection signatures for the Mach-O samples. Primary: Censys; wire: Cyber Security News.

UPDATE (8 Oct): iVerify separately reported a new DarkSword variant it calls P7 DarkSword, after the threat actor's p7_ code prefix, found while investigating an infected customer iPhone in August 2026. Compared with common variants it drops debug logging over HTTP and syslog, uses fewer process injections, uses browser localStorage to avoid re-exploiting the same phone, and converts keychain data to JSON on the device before sending it.

Its implant sits in SpringBoard and polls its server every 15 seconds for commands, with dozens of handlers for file browsing, uploads, running JavaScript, and pulling Apple Notes databases, recent photos and crypto wallet app data. iVerify also saw several unsuccessful, apparently AI-assisted attempts to port the leaked kit to iOS 26 and published indicators of compromise. Keep iPhones on current iOS and use Lockdown Mode for high-risk staff.