Inside the iOS Exploit Underground: Crypto Theft Executive Summary Since late 2025, a cybercrime ecosystem has rapidly taken shape around a clear objective: exploit vulnerabilities in older iOS versions to steal Web3 private keys and crypto assets. At its core are two nation-state-grade, full-chain iOS exploit kits: Coruna, covering iOS 13.0–17.2.1, and DarkSword, covering iOS 18.4–18.7. Within a single year, both passed from commercial surveillance vendors to state-sponsored threat actors and then to cybercriminal groups. The source code leak in March 2026 opened the floodgates. Security industry telemetry now shows roughly **17,000 domains** hosting second-generation variants of the two toolkits. The ecosystem has already matured into an end-to-end criminal supply chain: - Upstream: Zero-day exploits are brokered and resold. - Midstream: Turnkey malware clients and admin panels are openly sold on Telegram. - Downstream: Operators distribute attacks through watering-hole sites, spoofed pages, QR-code phishing, supply-chain hijacking via expired domains, and even trojanized apps that pass Apple’s official App Store review. This report dissects that supply chain: the technical components of its arsenal, each stage of the attack chain, the division of labor and flow of funds, and the steps users should take during the current window of exposure. I. The Cost of Unpatched iOS: How the Attack Surface Takes Shape 1.1 The Patch Gap and the Legacy Device Base In this report, “outdated” refers to unpatched operating system versions, rather than the age of the hardware. The iOS security model rests on an ideal assumption: users install updates promptly. In practice, that assumption fails systematically at three levels. First, devices reach their upgrade ceiling. The iPhone X and earlier models top out at iOS 16, while older generations are limited to iOS 15. These devices will never receive new patches, creating a vulnerable installed base—and a market for exploitation—that only grows. Second, the patch gap creates an opportunity for attackers. The day a security fix is announced is often also the day the attack becomes public. For users who do not update, a gulf separates “officially patched” from “actually protected”—one wide enough for criminal operators to harvest victims on an industrial scale. Third, version-specific exploit development has become systematic. Modern exploit kits no longer rely on a single vulnerability working across every iOS release. They package separate exploit code for each version and select the appropriate code at runtime. Version diversity is no longer an obstacle. It turns outdated releases into a target list operators can systematically enumerate. 1.2 Why Private Keys Are a Priority Target The economics are straightforward. Stolen bank credentials still leave attackers facing fraud controls, transfer limits, and account freezes followed by appeals. Crypto seed phrases and private keys offer four distinct advantages: - Hard to freeze: No central authority can arbitrarily reverse an onchain transfer. - Rapid monetization: Assets can be moved in seconds. - High value per device: Crypto holdings on a single mobile device often range from tens of thousands to millions of dollars. - No victim confirmation required: The entire theft can proceed without the victim confirming anything. Another factor is often overlooked: user behavior. A substantial share of crypto holders keep screenshots of their seed phrases in photo libraries, copy them into notes, or save them in chat bookmarks. For attackers, these are goldmines. This is no coincidence. It reflects deliberate, detailed research into how users store the secrets that control their assets. II. The Exploit Arsenal: Attack Chains and Trojanization Cases 2.1 Coruna: An Exploit Toolkit Spanning iOS 13–17 Publicly disclosed on March 3, 2026, Coruna—previously tracked within the mobile security industry as CryptoWaters—covers the widest range of iOS versions of any publicly documented exploit toolkit. It packs five complete exploit chains and 23 individual exploits, covering every release from iOS 13.0, launched in September 2019, through iOS 17.2.1, released in December 2023. It supports both arm64 and arm64e architectures. Industry estimates put its development cost at $30 million–$40 million. This is not something an ordinary attack team could build. Its developers could be called professional arms dealers of the digital age. The vulnerability matrix below breaks down the toolkit by attack stage. Two exploits used for privilege escalation and PPL bypass—Photon and Gallium—are the same ones used in Operation Triangulation in 2023. Their appearance in both operations provides direct evidence of advanced exploit technology circulating between threat actors. The JavaScript framework uses a minimal but distinctive obfuscation scheme: both strings and integers are XOR-encoded and decoded only at runtime. Resource URLs never appear directly in the code. Instead, they are derived from a hardcoded cookie using sha256(COOKIE + ID)[:40]. Later-stage binary payloads are delivered under .min.js paths to disguise their contents. A custom file format begins with the magic value 0xf00dbeef and uses per-blob ChaCha20 encryption with independent keys, alongside LZW compression. Each payload carries metadata specifying the chipsets and iOS versions it supports. If exploitation fails, the toolkit proactively deletes crash logs associated with com.apple.WebKit.WebContent, powerd, and panic to minimize forensic traces. At the end of the chain sits PlasmaLoader, an implant identified as com.apple.assistd, which injects into the powerd daemon running as root. The core payload is then injected into locationd, imagent, and SpringBoard. The first serves as the coordination hub; the latter two handle an SMS-based fallback communications channel and interaction with the device’s home screen, respectively. The module list reveals the operation’s real objective. The implant retrieves a JSON configuration packaged in an encrypted 7z archive from http:///details/show.html. Stealer modules are then dynamically delivered based on the apps installed on the victim’s device. Public research has reconstructed the following configuration excerpt: There are 18 such modules, targeting major wallets including BitKeep, Bitpie, Coin98, Coinbase, Exodus, imToken, Krystal, MetaMask, MyTonWallet, Phantom, Skymavis, Solflare, Tonhub, Tonkeeper, TronLink, Trust Wallet, and Uniswap. Beyond these wallet-specific modules, the payload has three capabilities worth remembering: Photo-library scanning and QR-code decoding: It reads every image in the photo library and decodes embedded QR codes to extract addresses and private keys. Apple Notes scanning: It searches the full text of notes, matching against the BIP39 wordlist and keywords such as “backup phrase,” “备份短语” (“backup phrase”), and “银行账户” (“bank account”), then uploads matching content. Social-app communications interception: It hijacks communications data from WhatsApp and other social apps. Traces of further development by cybercriminal operators are equally clear. Logs inside the stealer modules are in Chinese—for example, %s[%d]: CorePayload 管理器初始化成功，尝试启动... (“CorePayload manager initialized successfully, attempting to start…”). Some comments contain emoji, and the writing style strongly suggests LLM-generated text. One example is the heartbeat initialization message “✅ 心跳监控已启动” (“✅ Heartbeat monitoring started”). For exfiltration, data is encrypted with AES, using the SHA-256 hash of a fixed string as the key, and sent back through POST requests. Some requests include custom sdkv and x-ts headers. If the hardcoded C2 endpoint becomes unavailable, the malware falls back to a domain generation algorithm (DGA) seeded with the string lazarus. It generates .xyz domains with 15-character labels and uses public DNS resolution to check whether they resolve successfully. Coruna’s path through the threat ecosystem unfolded in three stages: February 2025: Security researchers first captured portions of the exploit chains being used by a customer of a commercial surveillance vendor. Summer 2025: UNC6353, a suspected Russia-linked espionage group, deployed the toolkit in watering-hole attacks targeting Ukraine. The group compromised websites in the industrial equipment, retail, and e-commerce sectors, embedding hidden iFrames pointing to cdn.uacounter[.]com/stat[.]html. The exploits were served only to iPhone users from selected geographic locations. Late 2025–early 2026: Financially motivated group UNC6691 deployed the same toolkit indiscriminately across numerous Chinese-language sites impersonating financial and crypto services. These fake exchanges and airdrop pages explicitly told visitors: “This page supports iOS devices only. Please visit using an iPhone or iPad”—precisely filtering for their intended victims. 2.2 DarkSword: Built for iOS 18, Entirely in JavaScript Jointly disclosed by several security organizations on March 18, 2026, DarkSword targets iOS 18.4–18.7 and was first observed in the wild in November 2025. Its defining design difference from Coruna is that every stage, including the final payload, is implemented in JavaScript. This sidesteps two of Apple’s toughest kernel mitigations: PPL (Page Protection Layer) and SPTM (Secure Page Table Monitor). These mitigations target the execution of unsigned native code; an all-JavaScript payload does not need to execute unsigned native code. The complete chain uses six CVEs, three of which were being exploited as zero-days when first observed. The landing page first checks the uid key in sessionStorage to prevent repeat infections, then inserts a hidden iFrame to load frame.html. That page uses document.write to include rce_loader.js. The loader retrieves the appropriate rce_worker_18.x.js for the device’s iOS version and runs the exploit logic in a Web Worker, coordinating with the main thread through postMessage. When Chrome is detected, the page redirects the user to Safari through the x-safari-https:// protocol handler—indicating that this chain has only a WebKit implementation. Bugs in the loader are revealing: some operators implemented version checks incorrectly and served the same exploit to every device; others did not even realize iOS 18.7 had already been released. These rough edges point to code that has changed hands repeatedly, with buyers of varying skill levels making their own fixes. Public research documents three early deployments: November 2025: UNC6748 targeting Saudi users. The group used snapshare[.]chat, a site impersonating Snapchat, to deliver GHOSTKNIFE, a JavaScript backdoor. It uses a custom binary protocol with ECDH and AES and can steal account data, messages, location data, audio recordings, and screenshots. During execution, it writes intermediate files to /tmp/./STORAGE and periodically deletes crash logs associated with mediaplaybackd, SpringBoard, com.apple.WebKit., and panic-full-. November 2025: PARS Defense operating in Turkey. The Turkish commercial surveillance vendor showed markedly better operational security (OPSEC). Its loader and all subsequent stages were obfuscated, and exploit delivery was encrypted throughout using ECDH and AES. In January 2026, another customer of the vendor operated in Malaysia. That deployment added an extensive set of device-fingerprinting checks to the landing page: Apple Pay availability, the standalone property, CSS backdrop-filter support, WebGL2, whether the Vibration API is present, and debugger detection. It deployed the GHOSTSABER backdoor, which supports 17 command types, including arbitrary SQLite queries, file exfiltration, and EvalJs. From December 2025: UNC6353 targeting Ukraine. The previously discussed group incorporated DarkSword into its watering-hole campaign through static.cdncounter[.]net/widgets.js. Its payload, GHOSTBLADE, is a comprehensive data harvester. It steals iMessage, Telegram, and WhatsApp databases, keychain contents, Wi-Fi passwords, photos, notes, crypto wallet data, Safari browsing history, and even health data. Based on its coding style and the depth of its library integration, researchers assess that GHOSTBLADE was most likely written by DarkSword’s original developer. Paths left in the webpack bundle also exposed an internal development framework named TaskRop and a reference to an unimplemented startSandworm() function. 2.3 Evolution After the Leaks: P7, Hybrid Variants, and gooll In March 2026, Coruna samples and decoded payloads appeared on GitHub, followed by readable source code for the entire DarkSword exploit chain. Section 4.1 provides the repository timeline. Over the subsequent months, criminal development of the two toolkits proceeded along three tracks. The first was substantial reengineering. Disclosed in early October 2026, the P7 DarkSword variant—named after the p7_ variable prefix in its code—removed HTTP and syslog debug logging. Instead of uploading the entire keychain database for server-side decryption, it extracts the data into JSON on the device before exfiltrating it. It also added bidirectional C2 with a 15-second heartbeat and 17 remote commands, including wallet_scan, wallet_extract (specifically targeting imToken), photo_scan, memo_scan, disk_scan, and exec. Browser localStorage prevents repeated exploitation of the same device. Mobile security research confirmed that the attackers possess Coruna’s source code: the changes were made through recompilation from source, rather than binary patching. The second was hybridization and splicing. Telemetry shows that some operators deploy both attack chains and even combine techniques from the two into hybrids informally dubbed DarkCoruna or Darkuna. Second-generation variants generally feature stronger jailbreak and virtualization detection, stronger encryption, and enhanced persistence mechanisms. Dedicated Telegram implants have also emerged. Meanwhile, numerous LLM-assisted imitations are circulating, many of them nonfunctional “AI slop.” The criminal market, too, is a mix of capable tools and unusable junk. The third was integration for full version coverage. Analysis of a Chinese-language operator’s production server uncovered a previously undocumented third delivery chain, gooll. Its gooll.html targets only devices running versions below iOS 18. Devices on iOS 18 or later are automatically redirected to /ios18/frame.html, entering the DarkSword branch. The two chains are seamlessly integrated. gooll’s kernel stage deserves particular attention. It abandons per-model offset tables entirely in favor of runtime fingerprinting: reading the XNU kernel build number, scanning drivers for byte signatures, and probing for the presence of IOKit services to select the appropriate exploit path dynamically. It uses five independent memory-access backends, falling back from one to the next in sequence. For PPL bypass, it includes two approaches: page-table forgery and ECC-aware writes. Every kernel write is self-verified through a write–readback–compare sequence. None of the binaries contain CVE identifiers—a hallmark of closed-source commercial toolkits that deliberately conceal the vulnerabilities they exploit. Its XNU version gates also match the version table in DarkSword’s 18.x chain, providing strong evidence that the two chains share a common origin. 2.4 FomoPeek: Bringing a Kernel Exploitation Framework to the App Store Web-based watering holes still require victims to visit the wrong site. The FomoPeek case, exposed in September 2026, showed that attackers can instead enter Apple’s official storefront and wait for victims to come to them. This is the report’s most extensively examined case: the forensic evidence is detailed enough to reveal every component of the attack chain. Packaging and user acquisition. Listed on the App Store as “FomoPeek – Whale Tracker & Smart Alerts,” the app presented itself as a whale-monitoring tool for Solana, Ethereum, and TRON. It explicitly promised “read-only access, no wallet connection, no seed phrase required.” It had a website, an official X account, and a free listing in the Finance category—all the outward signs of a legitimate project. Promotion ran through crypto influencers and communities. Users downloaded and registered with an invitation code, set a security code, and added wallets to monitor. They could earn 5–7 USDT by spending five to seven minutes in the app on a physical device, with “one opportunity per iPhone.” That time requirement was no marketing gimmick. As discussed below, its embedded cicuta_virosa exploit strategy takes more than two minutes per run. The campaign rules fit the technical requirements precisely. Trojanization timeline. The domain was registered on August 28, 2026, and version 1.0 appeared on the App Store on August 29. Version 1.1 (build 105), released on September 9, introduced the malicious modules. Version 1.2 (build 110), released on September 12, retained them. Version 1.3, released on September 17, removed both malicious frameworks entirely, shrinking the IPA from 10.47 MB to 1.81 MB. The malicious modules and the main executable were signed under the same Apple signing identity. The original IPA retained FairPlay encryption metadata, confirming that it was an App Store-distributed build, rather than a re-signed or sideloaded copy. By September 16, victims had already posted public theft warnings on X. Static analysis. The two malicious frameworks had distinct roles: apptrace handled C2 communications, while libapptracecore handled kernel exploitation and data collection. The main executable loaded both at startup through non-weak LC_LOAD_DYLIB commands. Yet all 1,048 imported symbols in its symbol table came from system libraries, with no explicit calls to framework class or method names. Even tracing three call levels from 34 C++ static initialization functions failed to reach the attack code. From a static-analysis perspective, these were two sleeper modules: loaded at launch and waiting for remote activation. Inside libapptracecore was a complete exploit arsenal: eight kernel exploit strategy classes inheriting from a common interface, each with a built-in check for whether the current device was supported. They declared coverage of iOS 12.0–18.7.2 and 26.0–26.1. The model table included devices from 2023–2025, including the iPhone 16 and 17 series. One strategy was explicitly named DarkSwordStrategy, covering the 16.7–18.7.2 and 26.0–26.1 ranges. Strings in the kernel components made their purpose clear: