DarkSword and Coruna iOS exploits continue to attack crypto wallets

A new report by security researchers at Censys warns that the DarkSword exploit on iOS continues to be used in conjunction with Coruna malware to steal cryptocurrency wallets. Discovered earlier this year, DarkSword/Coruna is a dual-edged hacking toolkit. DarkSword attacks WebKit and JavaScriptCore to access iOS’s SpringBoard that managing app launch and the Home screen. Coruna is the payload used to steal crypto wallet information.

Censys’ research found several servers that had DarkSword/Coruna deployment directories. Wallet apps being targeted include Bitpie, Coinbase, Exodus, imToken, MetaMask, Phantom, Trust Wallet, Uniswap, and OKEx. According to the site’s researchers, the exploit’s main purpose is wallet theft and also “mines Photos and Notes for BIP39 recovery phrases.”