What DarkSword and Coruna Actually Do
Security researchers at Censys have published new findings showing that an iPhone attack toolkit first identified earlier this year is still being actively deployed. The toolkit has two parts that work together, and understanding each one helps explain why it is dangerous.
DarkSword is the break-in tool. It targets WebKit, the engine that renders web pages on iPhones and iPads, and JavaScriptCore, the component that runs the scripts on those pages. On iOS, every browser uses WebKit under the hood, including Chrome, Firefox, and Edge. That means switching browsers does not get you out of the line of fire. Once DarkSword exploits those components, it works its way toward SpringBoard, the part of iOS that manages your Home screen and launches your apps. Control at that level gives an attacker a strong foothold on the device.
Coruna is the payload, the part that does the stealing once DarkSword has opened the door. According to the researchers, its main purpose is taking cryptocurrency wallet data. The wallet apps named include Coinbase, MetaMask, Exodus, Trust Wallet, Phantom, Uniswap, imToken, Bitpie, and OKEx. If you have dabbled in crypto even casually, there is a good chance at least one of those is on your phone.
Censys found multiple servers hosting deployment directories for this toolkit. In plain terms, the infrastructure needed to deliver the attack is still up and running. This is not a theoretical proof of concept sitting in a research lab. Someone is maintaining these servers because the attack is still producing results.
The most common delivery route for browser-engine exploits like this is a malicious or compromised web page. You might reach that page through a text message link, a sketchy ad, a fake crypto promotion, or a phishing email designed to look like it came from your exchange. The page loads, the exploit runs, and the user may notice nothing unusual at all.
The good news is that this type of attack relies on vulnerabilities that Apple works to close through software updates. Devices that are fully up to date are in a much better position than ones that have been sitting on an older version of iOS for months.
Why This Matters Here in Bucks County
It is tempting to think of crypto theft as a problem for big-city day traders or tech workers on the West Coast. Our experience working with households and small businesses around Washington Crossing, Newtown, Yardley, and the rest of Bucks County says otherwise.
Over the past few years we have seen a steady rise in local clients holding at least some cryptocurrency. Some are retirees who bought a little Bitcoin after hearing about it from grandchildren. Some are professionals in Newtown who keep a small portion of their savings in Ethereum. Others are small business owners who experimented with accepting crypto payments. Many of them set up a wallet app on their iPhone once, wrote down the recovery phrase somewhere convenient, and have not thought about it since.
That last group is exactly who this toolkit is built to exploit. Attackers are not necessarily looking for the biggest whales. Automated tools like Coruna are designed to sweep up whatever they find on any device they compromise. A wallet holding a few thousand dollars is still worth the effort when the process is automated.
Our area also has a high concentration of Apple households. It is common for us to visit a home where everyone has an iPhone, an iPad, and a Mac, all signed into the same iCloud account or a Family Sharing group. That ecosystem is convenient, but it also means a mistake on one device can ripple across all of them, which we cover in the next section.
There is also a common belief, especially among longtime Mac users, that Apple devices simply do not get malware. Apple’s platforms are well designed and generally safer than many alternatives, but that reputation can lead to complacency. People delay updates, ignore warnings, and store sensitive information in places they would never consider on a Windows PC. Toolkits like DarkSword exist precisely because attackers know iPhones are carrying valuable data.
Finally, crypto theft is uniquely painful. When a credit card is misused, your bank can usually reverse the charges. When cryptocurrency leaves your wallet, it is almost always gone for good. There is no fraud department to call and no chargeback process. Prevention is the only real protection.
The Hidden Risk in Your Photos and Notes
One detail from the Censys research deserves special attention. Beyond targeting wallet apps directly, the toolkit also searches the Photos and Notes apps for BIP39 recovery phrases.
If you are not familiar with the term, a recovery phrase (sometimes called a seed phrase) is the list of 12 or 24 words a crypto wallet gives you when you set it up. Those words are the master key to your funds. Anyone who has them can restore your wallet on their own device and move everything out. Your PIN, Face ID, and wallet password do not matter at that point.
Here is the uncomfortable truth: a large number of people store their recovery phrase in exactly the places this malware is searching. We regularly see clients who took a screenshot of the phrase during setup, snapped a photo of the paper card it was written on, or typed it into a note titled something like Crypto Backup. It feels responsible at the time because you will not lose it. Unfortunately, it also means anyone who gets into your phone can find it in seconds.
For Mac users, there is an extra wrinkle. If you use iCloud Photos or sync Notes through iCloud, that screenshot or note does not just live on your iPhone. It also lives on your Mac, your iPad, and on iCloud.com. Even if this particular exploit targets iOS, the information it is hunting for may be sitting on every Apple device in your home. Deleting it from your phone alone is not enough. You also need to check the Recently Deleted folders in both Photos and Notes, because items stay there for about 30 days before they are permanently removed.
Locked notes and the Hidden album add some protection, but they should not be considered a safe home for a recovery phrase. The safest approach remains the old-fashioned one: write the words on paper or stamp them on a metal backup plate, and store that somewhere physically secure, such as a home safe or a bank safe deposit box. Keep it off any device that connects to the internet.
Practical Steps to Take This Week
You do not need to be a security expert to dramatically reduce your exposure. Here is the checklist we are walking our own clients through right now.
- Update every Apple device. On your iPhone and iPad, go to Settings, then General, then Software Update. On your Mac, open System Settings, then General, then Software Update. Install whatever is available. Browser-engine exploits like DarkSword depend on unpatched devices, and staying current is your single most effective defense.
- Turn on automatic updates. In the same Software Update screen, enable automatic updates and, if offered, the option to install security responses automatically. This keeps you protected even when you forget to check.
- Search for exposed recovery phrases. Open Photos and search for words like seed, recovery, wallet, or phrase. iOS and macOS can recognize text inside images, so this often surfaces screenshots. Do the same in Notes. Move anything you find to paper, then delete the digital copy and empty Recently Deleted.
- Consider moving larger balances. If you hold a meaningful amount of crypto on a phone wallet, look into a dedicated hardware wallet that keeps your keys off your iPhone entirely.
- Be skeptical of links. Avoid tapping links in unexpected texts or emails about your crypto account, airdrops, giveaways, or urgent security alerts. Go directly to the app or type the website address yourself.
- Consider Lockdown Mode if you are a higher-risk user. Found in Settings under Privacy and Security, Lockdown Mode restricts many web technologies that exploits like this rely on. It does change how some websites and features behave, so it is best suited to people with substantial holdings or elevated risk.
- Remove wallet apps you no longer use. If you set up a wallet years ago and transferred everything out, delete the app. Less data on the device means less to steal.
None of these steps takes more than a few minutes, and together they close off most of the paths this toolkit uses.
If You Suspect Something Is Wrong, and the Bigger Picture
Because exploits like DarkSword are designed to run quietly, you may not see obvious warning signs. Still, there are clues worth paying attention to: unexpected transactions in a wallet, a wallet app asking you to re-enter your recovery phrase out of the blue, unusual battery drain or heat, or your phone behaving strangely right after visiting an unfamiliar website.
If you believe your recovery phrase may have been exposed, act quickly. The most important step is to create a brand-new wallet on a clean device and transfer your funds into it as soon as possible. Simply changing a password does nothing, because whoever has your phrase can still access the old wallet. Once your funds are safe, update your iPhone, change your Apple Account password, review which devices are signed in to your account, and remove any you do not recognize. Restoring the phone from scratch rather than from a backup is a reasonable precaution when you have serious concerns.
It is also worth reporting theft to your exchange, if one was involved, and to the FBI’s Internet Crime Complaint Center. Recovery is rare, but reports help investigators connect cases and occasionally freeze stolen funds at exchanges.
Stepping back, this story is a good reminder of how modern threats work. Attackers chain multiple weaknesses together: one piece to break in through the browser, another to gain deeper control, and a final payload to grab what is valuable. They focus on whatever data is worth money, and right now cryptocurrency is at the top of that list because it is fast to move and nearly impossible to recover.
For our neighbors in Washington Crossing, Newtown, and across Bucks County, the takeaway is not to panic or to swear off crypto entirely. It is to treat your iPhone like the powerful, valuable computer it is. Keep it updated, keep your most sensitive secrets off of it, and think twice before tapping a link you were not expecting. Those habits will protect you not only from DarkSword and Coruna, but from whatever comes next.
Source
Based on reporting from Macworld.
Contact G2 Computers in Washington Crossing
Need help? Contact G2 Computers today.
