Earlier this year, a nasty exploit plagued iPhone in what was called the “biggest iPhone threat in 19 years.” Unfortunately, several months later, that exploit is still causing trouble, and it is joined by another vulnerability, all aimed to steal money from some of the financial apps on your phone.
The two exploits are called Coruna and DarkSword, respectively. We covered both of them here on Blaze News, so you may have heard these names before. Both of them were problematic earlier this year, but a new report reveals that they are still plaguing users.
The easiest way to thwart bad actors is to keep your phone updated with the latest bug fixes and security patches.
Macworld describes the exploits as two sides of the same coin: “DarkSword/Coruna is a dual-edged hacking toolkit. DarkSword attacks WebKit and JavaScriptCore to access iOS’s SpringBoard that [manages] app launch and the Home screen. Coruna is the payload used to steal crypto wallet information.”
Together, the exploits are aimed directly at crypto wallets stored on users’ iPhones. Censys, the cybersecurity company that discovered the ongoing issue, got ahold of some of the data that an undisclosed hacker stole via these exploits. Among the recovered data from real victims, Censys found “11 victim recovery phrases, 179 device loot directories, and a 75-account control-plane roster.”
That is proof enough that these exploits are still dangerous to vulnerable users.
In addition to the collected data, Censys found evidence that another hacking group — this time based in China — is actively using the exploits to attack victims, though the report doesn’t say who or where.
So far, Censys found that bad actors using the exploits are targeting only 18 different crypto wallets, but several of them are popular in the United States. These include Coinbase, MetaMask, Trust Wallet, Exodus, Bitpie, imToken, Phantom, Uniswap, and OKEx.
RELATED: Your iPhone has state-of-the-art security features. Law enforcement has a new way to disable them.
Hleb Usovich/Getty Images
The good news is that there are ways to protect your device and, by association, your crypto wallets.
Apple patched DarkSword earlier this year, but the fix only works if you have the correct software downloaded and installed on your device. To check, open the Settings app on your iPhone and tap “General,” followed by “Software update.” If the number that appears is iOS 26.3 or higher, you’re safe. If your device is running a lower version of iOS 26, or if you’re still on iOS 18 from the previous year, your crypto wallet could be in danger. Update your phone to the latest version available now.
As for Coruna, this exploit mostly affected older devices from iPhone 5s to iPhone 11. If you still have one of these devices, make sure you have updated it to any of these iOS versions or better, depending on the model of your phone:
- iOS 26.3.1
- iOS 18.7.5
- iOS 16.7.14
- iOS 15.8.6
- iOS 12.5.8
Both exploits have also been fully addressed on the newest version of iOS 27 that launched this fall. Along with optimal protection from bad actors, iOS 27 comes with a number of interesting features, including the new Siri, better parental controls, and a more accessible Visual Intelligence.
Although these exploits are still rearing their ugly heads, the easiest way to thwart bad actors is to keep your phone updated with the latest bug fixes and security patches. This way, even if there is a problem, Apple can address it on your device as quickly as possible and keep your data safe.
Like Blaze News? Bypass the censors, sign up for our newsletters, and get stories like this direct to your inbox. Sign up here!