iOS Exploit Kits Can Compromise iPhones Through a Single Malicious Website

A single visit to a compromised or deceptive website can let a sophisticated exploit kit take control of a vulnerable iPhone.

On the Packet Protector podcast, mobile security architect Akili Akridge warned that Coruna and DarkSword demonstrate how surveillance-grade capabilities have moved into criminal hands and why enterprise defenses built around apps and network traffic may miss an infection.

Google’s Threat Intelligence Group documented five Coruna exploit chains containing 23 exploits, targeting iOS 13.0 through 17.2.1.

iVerify’s analysis of DarkSword found a one-click chain aimed at iOS 18.4 through 18.6.2.

The attack can begin when a user opens a compromised legitimate site or a fake finance page.

Malicious JavaScript exploits Safari’s WebKit engine, then attempts to escape the browser sandbox and escalate privileges through the operating system.

In DarkSword, researchers documented stages that move from Safari’s WebContent process through the GPU process and into privileged system processes, ultimately reaching the kernel. The chain can then run implants in memory to collect data.

That access makes the impact broader than browser activity. DarkSword’s implants were designed to collect sensitive material including keychain data, Wi-Fi passwords, messages, location history, and files associated with cryptocurrency wallets.

For organizations, a compromised phone may expose both personal information and credentials used to reach corporate services.

The kits’ history illustrates the risk of powerful exploit tools changing hands.

Google tracked Coruna from use by a surveillance-vendor customer to a suspected Russian espionage operation targeting Ukrainian users, and later to financially motivated campaigns using fake finance websites.

iVerify Researchers said that, Coruna and DarkSword are exploit kits: collections of vulnerabilities and exploit stages assembled into a chain.

iOS Exploit Kits

DarkSword was disclosed by iVerify in collaboration with Lookout and Google; its source code subsequently appeared publicly.

Researchers later reported that attackers were combining DarkSword and Coruna in a single deployment, dubbed DarkCoruna, to target a wider range of iOS versions from one website visit.

iVerify said its September 2026 telemetry found live and historic Coruna attacks on vulnerable devices affecting 5% of devices it measured, compared with 1.5% in August.

Keeping iOS updated is a critical first step: updates address vulnerabilities exploited by these chains. But a patched device is not the only defense enterprises need, particularly when a device’s software status or compromise is unknown.

Apple’s Lockdown Mode reduces exposure by restricting certain web technologies and features.

It is not a universal enterprise control: it must be enabled before a malicious page loads to block the attack path described by Akridge, and it limits everyday functions.

Apple notes that some websites may not work as expected, most message attachment types are blocked, and a device cannot be enrolled in MDM while Lockdown Mode is on. Devices already enrolled remain managed.

Akridge’s guidance centers on fleet-wide visibility, not just protection for executives.

Organizations should assess which corporate resources each mobile identity can reach, restrict access to what each role requires, and monitor identity activity alongside device telemetry.

He also recommends maintaining ready-to-issue loaner phones so suspected devices can be replaced quickly and preserved for investigation. Executive protection should include global administrators and the CISO, not only the C-suite.

The detection challenge is technical: kernel-level implants operating inside legitimate processes may evade app-layer monitoring, while a short-lived infection that cleans up after itself can leave little for periodic checks to find.

The initial website connection may also look like ordinary HTTPS traffic.

Akridge therefore points defenders toward continuous, low-level mobile telemetry and mobile EDR-style detection, complemented by disciplined incident response.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.