New iOS malware DarkSword and Coruna enable zero-click attacks

DarkSword and Coruna are two new tools for invisible attacks on iOS devices. These attacks require no user interaction and are already being actively used by bad actors in the wild.

Before these threats most iPhone users did not worry much about data security. Protection mattered mainly for politicians, activists, diplomats and high-level executives.

DarkSword and Coruna, discovered by researchers earlier this year, change this. The malware now targets everyday users through mass infections.

DarkSword targets iOS 18 devices. In mid-March 2026 three research teams reported findings on this spyware. It silently infects devices when users visit legitimate websites injected with malicious code. No user action is needed. Researchers say several thousand devices have been hit.

DarkSword uses a six-vulnerability exploit chain. It harvests passwords, photos, chats from iMessage, WhatsApp and Telegram, browser history, and data from Calendar, Notes and Health apps. It also steals crypto-wallet data.

The spyware is fileless and lives only in RAM. It disappears after a reboot.

Coruna targets older iOS versions from 13 to 17.2.1. It works the same way: zero-click infection via compromised websites. It exploits 23 vulnerabilities, many in WebKit. This affects all iOS browsers.

Coruna mainly steals cryptocurrency. It also takes photos and sometimes email data. At least 42,000 devices were infected in China.

Both tools were originally built by state-affiliated companies, likely from the US. They later leaked to cybercrime gangs. DarkSword has hit users in Saudi Arabia, Turkey and Malaysia.

To stay protected, update to the latest iOS or iPadOS 26. If not possible, install the newest supported version such as 15.8.7, 16.7.15 or 18.7.7.

Enable Background Security Improvements in Settings > Privacy & Security. Consider Lockdown Mode. Reboot your device daily. Use encrypted storage for sensitive data like crypto keys.