Hackers are leveraging the Coruna and DarkSword exploit chains across a vast web network to compromise vulnerable iPhones without requiring app installation or permission This article explores safedep zlabs. . Zimperium’s zLabs discovered 608 domains delivering Coruna-family code by October 2026, with configurations from 93 sites pointing to 21 tracking collectors.
The infrastructure uses dating pages, AI companion services, cryptocurrency promotions, streaming sites, and compromised legitimate websites.
Some lures prompt users to leave browsers inside apps, including TikTok, and re-open links in Safari, matching the environment required by the loader. Researchers discovered identical decoded JavaScript across various websites, despite modifications to campaign labels and tracking servers. Coruna supports older releases through iOS 17.2.1, while the recovered DarkSword-derived loader targets selected iOS 18 versions, including 18.4-18.5, 18.6, and 18.7.0-18.7.2.
Sources: GTIG, SafeDep, and zLabs (Source: zimperium) reveals recovered native modules include kernel memory access routines, code altering Apple's Mobile File Integrity state, and functions for reading process memory. Other components enable HTTPS communication with certificate validation disabled, removing diagnostic logs and Safari website data, reducing evidence available to investigators. Examples of lure-page content: dating, AI-companion chat, and legitimate casino content embedded in an attacker-controlled page (Source: zimperium).
This method allows trusted websites to expose visitors via malicious dependencies without the need for attackers to convince each visitor to open a separate lure site.
