Apple has issued an urgent warning to users of older versions of iOSas the Coruna and DarkSword exploit kits are actively targeting unpatched iPhones .These attacks use malicious web content to exploit vulnerabilities and steal sensitive data from millions of devices worldwide. The seriousness of the situation is underscored by the fact that these exploit kits represent a new era in cyberattacks, where state-level tools are becoming accessible to wider criminal circles.
See also: Apple: New iOS and iPadOS updates address Coruna exploit
The two exploit kitswere discovered by Google Threat Intelligence Group, iVerify , and Lookout in March 2026, with DarkSword first appearing in November 2025.According to the researchers’ analysis, DarkSword targets devices running iOS 18.4 to 18.7, while Coruna affects versions from iOS 13.0 to 17.2.1. The attacks are carried out via watering hole attacks, where malicious JavaScript is injected into compromised websites. This strategy allows attackers to target a large number of victims without having to identify specific individuals, making the attacks more effective and difficult to detect.
Apple emphasizes that users who have the latest version of the operating system do not need to take any action. "For example, if you are using an older version of iOS and click on a malicious link or visit a compromised website, the data on your iPhone may be at risk of theft," the company says in an official support document. The company emphasizes that it has thoroughly investigated these issues and has released software updates as soon as possible for the latest versions of the operating system.
Security researchers estimate that approximately 221.5 million devices ( 14.2% of iOS users ) running versions 18.4-18.6.2 remain vulnerable to DarkSword . Lookout estimates that a total of 15% of all iOS devices worldwide are affected, while iVerify reports that up to 270 million devices may be vulnerable to exploit kits like Coruna and DarkSword . These numbers demonstrate the sheer scale of the problem, as millions of users remain exposed to potential attacks that can lead to the theft of personal data, passwords, and even cryptocurrency.
See also: Apple's iPhone 5 is now listed as obsolete
Technical details of the Coruna and DarkSword exploits
DarkSword is a sophisticated exploit kit that exploits six different vulnerabilities, including three zero-day exploits. The main vulnerabilities include two in WebKit ( CVE-2025-43529 , CVE-2025-14174 ) and one in dyld ( CVE-2026-20700 ). The kit deploys payloads codenamed GHOSTBLADE , GHOSTKNIFE , and GHOSTSABER to gain access to the system kernel and extract data. DarkSword 's architecture allows for kernel-level code execution, bypassing all iOS security measures and giving attackers complete control over the device.
On the other hand, Coruna has 23 exploits organized into five attack chains and has been used by state actors and criminal organizations since 2019.Researchers have identified its use by groups UNC6353 (possibly of Russian origin) against Ukrainian targets and UNC6691 (of Chinese origin) to steal cryptocurrency. Coruna is characterized by researchers as a “spy-grade” tool, as it has advanced espionage and data extraction capabilities usually found only in state-owned tools.
The attacks are carried out through a simple process: when a user visits a compromised website, malicious JavaScript recognizes the iOS and triggers the appropriate chain of exploits. The entire process requires only one click from the user, without any further interaction. This technique, known as a “1-click exploit,” makes the attacks extremely dangerous as users do not realize they have been targeted until it is too late.
See also: iPhone 17e: What changes has Apple brought?
Practical protection tips and immediate actions
Apple recommends specific actions depending on the version of the operating system. For older devices that cannot be updated to the latest version, it recommends updating to iOS 15.8.7, iPadOS 15.8.7, iOS 16.7.15 , and iPadOS 16.7.15. For devices with iOS 13 or iOS 14, it recommends upgrading to iOS 15 along with a critical security update expected in the coming days. In addition, users should avoid visiting untrusted websites, especially in high-risk regions such as Ukraine and the Middle East, where increased exploit kit activity has been detected.
