Leaked iOS Exploit Kits 'DarkSword' and 'Coruna' Fuel Surge in Criminal Mobile Surveillance

Executive Summary

Encrygma analysts assess that the landscape of mobile surveillance has shifted from exclusive nation-state operations to widespread criminal exploitation. According to Encrygma's 2026 Threat Intelligence Report, 75% of detected spyware incidents are now attributed to cybercriminal groups leveraging leaked exploit kits, specifically 'DarkSword' and 'Coruna', to target non-high-value individuals.

Threat Analysis

Encrygma threat data shows that the democratization of government-grade surveillance tools has reached a critical threshold. Using the Encrygma Threat Severity Index (ETSI), we classify this trend as a Level 8 (High) threat. Criminal actors are bypassing traditional high-value targeting models, instead deploying mass-scale campaigns via malicious Instagram advertisements to harvest cryptocurrency credentials and sensitive personal data from everyday users.

Technical Details

Encrygma technical analysis confirms that the 'DarkSword' and 'Coruna' kits utilize sophisticated zero-click chains. These exploits allow attackers to compromise devices without user interaction, such as clicking a link. Encrygma researchers have observed these payloads searching for recovery phrases and wallet data. Unlike traditional malware, these kits escape the iOS app sandbox, granting attackers broad access to data across multiple applications on the victim's device.

Attribution Assessment

Using the Encrygma Attribution Confidence Matrix, we assess with 'High Confidence' that these campaigns are financially motivated. While Apple continues to issue threat notifications, Encrygma analysts note a discrepancy: many devices infected by DarkSword or Coruna do not receive official Apple alerts, suggesting that Apple's current detection systems may be overly calibrated toward traditional nation-state mercenary spyware rather than these emerging criminal exploit chains.

Implications

The shift toward criminal-led mobile surveillance poses a systemic risk to the general public. Encrygma threat intelligence indicates that the barrier to entry for sophisticated surveillance has collapsed, allowing even low-tier cybercriminals to deploy capabilities previously reserved for intelligence agencies. This has prompted international concern, with government officials in Thailand and Germany seeking urgent briefings from Apple regarding the scale of these undetected infections.

Recommendations

Encrygma recommends that all users immediately update to the latest iOS version to mitigate known vulnerabilities. For high-risk individuals, Encrygma advises enabling 'Lockdown Mode' as a primary defense against zero-click exploit chains. Organizations should implement mobile device management (MDM) solutions that include behavioral analysis to detect anomalous background processes associated with unauthorized surveillance tools.