Earlier this year, a significant vulnerability affected iPhones, dubbed the “biggest iPhone threat in 19 years.” Unfortunately, several months later, this exploit continues to cause issues and has been accompanied by another vulnerability, both of which target financial applications on users’ devices.
The two exploits are identified as Coruna and DarkSword. You might have come across these names in reports. They raised concerns earlier this year, and a fresh report suggests that users are still facing challenges due to them.
Keeping your phone updated with the latest security patches is arguably the best defense against such threats.
According to Macworld, these exploits can be viewed as complementary: “DarkSword/Coruna is a dual-edged hacking toolkit. DarkSword exploits WebKit and JavaScriptCore to gain access to iOS’s SpringBoard, which is responsible for app launching and the Home screen. Coruna serves as the payload for stealing crypto wallet information.”
Together, these exploits specifically target crypto wallets on iPhones. A cybersecurity firm, Censys, reported ongoing issues and managed to obtain data that a hacker gathered using these vulnerabilities. Among the information retrieved from actual victims were “11 victim recovery phrases, 179 directories containing device loot, and a 75-account control-plane list.”
This strongly indicates that these exploits remain a serious threat to susceptible users.
Additionally, Censys uncovered that another hacking group—based in China—is using these exploits for their attacks, though the specifics regarding the targets weren’t disclosed.
So far, Censys found that the exploits are honing in on just 18 different crypto wallets, many of which are widely used in the U.S., such as Coinbase, MetaMask, Trust Wallet, Exodus, Bitpie, imToken, Phantom, Uniswap, and OKEx.
There is, however, a silver lining: You can take steps to safeguard your device and, by extension, your crypto wallets.
Apple released a patch for DarkSword earlier this year. That fix is applicable only if you have the right software installed. To verify, go to the Settings app on your iPhone, tap “General,” and then “Software Update.” If you see iOS 26.3 or higher, you’re in the clear. If your device is running a lower version than iOS 26 or is still on iOS 18 from the previous year, it could jeopardize your crypto wallet. It’s best to update your phone as soon as possible.
On the topic of Coruna, it primarily impacted older models ranging from the iPhone 5s to the iPhone 11. If you’re using one of these devices, ensure you’ve updated to one of the following iOS versions or better, depending on your phone model:
- iOS 26.3.1
- iOS 18.7.5
- iOS 16.7.14
- iOS 15.8.6
- iOS 12.5.8
Both vulnerabilities have been fully rectified in the current version of iOS 27, which was launched this fall. Along with enhanced protection against hackers, iOS 27 boasts several features, including an upgraded Siri, improved parental controls, and a more user-friendly Visual Intelligence.
Although these exploits continue to pose a threat, the simplest way to combat hackers is to keep your phone updated with the latest patches and fixes. This ensures that even if an issue arises, Apple can quickly address it, helping to protect your data.
