cybersecurity•Sat, October 17, 2026•5 min read

The Dual-Threat iPhone Exploits You Need to Know About Right Now

Two dangerous iOS vulnerabilities, Coruna and DarkSword, are actively targeting cryptocurrency wallets on iPhones. Security experts warn that even users with older devices must update their software immediately to prevent data and financial theft.

A Persistent Threat to Your Digital Assets

If you keep your cryptocurrency on your iPhone, you need to pay attention. Two persistent exploit toolkits, known as Coruna and DarkSword, have emerged as a significant security threat. While these exploits were identified earlier this year, recent reports confirm they remain active, with bad actors using them to drain funds from popular mobile crypto wallets.

These exploits function as a two-pronged attack. DarkSword targets WebKit and JavaScriptCore to gain deeper access to the iPhone's SpringBoard—the component managing your app launches and Home screen. Once access is established, Coruna serves as the malicious payload, designed specifically to harvest crypto recovery phrases, balances, and sensitive keystore data.

Security researchers have identified Coruna and DarkSword as active threats to iOS users.

How the Attack Works

Cybersecurity researchers at Censys discovered that these toolkits are not just theoretical; they have recovered data from real victims, including recovery phrases and account control-plane rosters. The exploits target a variety of high-profile crypto applications, including:

Coinbase
MetaMask
Trust Wallet
Exodus
Bitpie
imToken
Phantom
Uniswap
OKEx

The danger is compounded by the fact that all iOS browsers are forced to use the WebKit engine. This means the threat isn't limited to Safari; users of third-party browsers on iOS are equally vulnerable to these exploits.

How to Secure Your Device

The most effective defense against Coruna and DarkSword is to ensure your iPhone is running the latest security patches. Apple has addressed these vulnerabilities in recent software updates, but the fix is only effective if you have installed the update.

To check your status, navigate to Settings > General > Software Update. If your device is running iOS 26.3 or higher, you are protected against DarkSword. For users on older hardware, ensure you have updated to the latest available version provided by Apple, such as iOS 18.7.5, 16.7.14, or 15.8.6.

The easiest way to thwart bad actors is to keep your phone updated with the latest bug fixes and security patches. This way, even if there is a problem, Apple can address it on your device as quickly as possible and keep your data safe.
— Security Advisory

Key Takeaways

Coruna and DarkSword are dual-threat hacking tools targeting iPhone crypto wallets.
The exploits gain access through WebKit to steal recovery phrases and private keys.
Popular wallets like MetaMask, Coinbase, and Phantom are specifically targeted.
Updating to iOS 26.3 or higher is the primary defense against DarkSword.
Users on older iPhones should install the latest available patch (e.g., 18.7.5, 16.7.14) to stay protected.

FAQ

What is the Coruna/DarkSword exploit?

It is an iOS exploit chain where DarkSword breaches system access and Coruna functions as a payload to steal cryptocurrency wallet data.

Which crypto wallets are at risk?

Users of popular wallets like Coinbase, MetaMask, Trust Wallet, Exodus, and several others are the primary targets.

How do I know if my iPhone is safe?

Check your iOS version in Settings. If you are on iOS 26.3 or higher, you are protected against the known DarkSword exploit.

Can I get infected if I don't use Safari?

Yes. Because all iOS browsers are required to use the WebKit engine, the vulnerability exists regardless of which browser you use.

What should I do if I have an older iPhone?

Ensure your device is updated to the absolute latest version supported for your model, such as iOS 15.8.6 or 16.7.14.