Sophisticated iPhone exploit chains previously limited to nation-states are spreading far and wide to organized cybercrime groups.
August 10, 2026
The advanced iPhone exploit chains Coruna and DarkSword continue to escape nation-state and mercenary containment to enter the hands of more conventional cybercriminals.
While nation-state-grade malware will, from time to time, make its way from government use to cybercriminal adoption, it's far more unusual to see whole complex exploit chains — especially those targeting iOS — adopted broadly. Yet that phenomenon, first observed last spring, appears to be shifting into overdrive. iVerify has tracked approximately 17,000 domains hosting second-generation iterations of Coruna and DarkSword so far, and infections have continued months after public disclosure earlier this year.
"In five minutes, you can deploy an iOS exploit chain. ... This is extremely dangerous and extremely easy to proliferate," says Matthias Frielingsdorf, vice president of research at iVerify.
