Hacking campaigns by the names of Coruna and Darksword have been detected by cybersecurity companies, iVerify and Lookout, on March 3, 2026.
These hacking campaigns originated back in summer of 2025, when hackers that were associated with Russian intelligence groups began to create a large set of scam finance websites, as NBCNews said.
iVerify and Lookout have been undergoing research ever since this discovery, and have found significant information. According to NBCNews, this data shows that the Coruna and Darksword campaigns are being led by people from Russian intelligence and Chinese cybercriminals. These cybercriminals are currently focusing on attacks directed to Ukrainians, Saudi Arabians, Turks, Chinese cryptocurrency users, Malays, and people with outdated apple phones.
The versions prone to these exploitation attacks are iOS versions 18.4 and 18.6.2, which were available to iPhone users between March and Aug. 2025, as shown on The Detroit News. To support this further, an Apple spokesperson stated, “Keeping software up to date remains the single most important thing users can do to maintain the high security of their Apple devices,”. Highlighting the importance of updating iPhones and preventing the likelihood of these cybercriminals to hook onto people’s devices.
These attacks have begun not only through outdated phones, but websites too. This is because The Hacker News shows that the Coruna attacks start when a user visits via Safari web page, it plants an iFrame, a nested window that allows content from other websites to be displayed, through a JavaScript. JavaScript is an enablement to interactive behavior on web pages. Once this is executed, Darksword is able to inject a system that allows media playback functions. This all ultimately turns on a dataminer malware, “The GHOSTBLADE”, which gains access through extremely private information from a device’s file system.
Ultimately, the creation of these dangerous exploitation kits have caused commotion in the responsibility of loads of phones actively being hacked. Cybersecurity companies are working to shut it down and are warning people about the consequences of not updating their phone or clicking sketchy websites.
