Apple Issues Urgent Warning: Older iPhones Vulnerable to Coruna and DarkSword Exploits

Apple has issued a critical alert, urging users of older iPhone models to update their software immediately. The company warns that devices running outdated versions of iOS are susceptible to sophisticated attacks leveraging powerful exploit kits known as Coruna and DarkSword. These web-based attacks can lead to the theft of sensitive personal data.

Key Takeaways

• Older iPhones running outdated iOS versions are vulnerable to Coruna and DarkSword exploit kits.

• These kits deliver malicious web content to compromise devices and steal sensitive data.

• Apple strongly advises users to update to the latest iOS versions for protection.

• Devices with updated software are not at risk.

The Threat Landscape

Coruna and DarkSword are advanced exploit kits that leverage malicious web content to target iPhones running older iOS versions. By visiting a compromised website or clicking a malicious link, users could trigger an infection chain that allows attackers to steal sensitive data from their devices. Apple has confirmed that devices running the latest iOS versions, including iOS 15 through iOS 26 with the most recent updates, are protected against these threats.

Recommended Actions

Apple is strongly recommending the following steps for users with older devices:

• Update to the latest iOS version: For devices that can support it, updating to the newest iOS version is the most effective way to stay protected.

• Install specific updates for older devices: For devices that cannot run the latest iOS, Apple recommends updating to iOS 15.8.7, iPadOS 15.8.7, iOS 16.7.15, and iPadOS 16.7.15.

• Upgrade to iOS 15: Users on iOS 13 or iOS 14 should upgrade to iOS 15 and install an expected Critical Security Update.

• Enable Lockdown Mode: If updating is not an option, enabling Lockdown Mode can reduce the attack surface and offer protection against malicious web content.

Exploit Kits Evolve

These exploit kits represent a shift from highly targeted espionage attacks to broader, more accessible tools. Researchers have noted that the relative simplicity of deploying these exploits, coupled with their rapid adoption by various threat actors, indicates that powerful mobile exploitation tools are now readily available on the secondary market. This trend suggests that nation-state-grade mobile exploitation capabilities are becoming accessible for mass attacks, posing a critical concern for all users and enterprises.

Who is at Risk?

While specific attacks have targeted individuals in Ukraine (by Russian intelligence), cryptocurrency users in China, and people in Saudi Arabia, Turkey, and Malaysia, experts warn that any user with an outdated operating system is potentially at risk. The ease with which these tools can be repurposed and redeployed makes it highly likely that modified versions are actively infecting unpatched users globally.

Apple emphasizes that keeping software up to date is the single most important action users can take to maintain the security of their devices. Devices with updated software were not at risk from these reported attacks.

Sources

• Apple Warns Older iPhones Vulnerable to Coruna, DarkSword Exploit Kit Attacks, The Hacker News.

• Apple urges iPhone users to update as Coruna and DarkSword exploit kits emerge, Security Affairs.

• iPhone users should update software amid hacking campaigns, NBC News.

• Outdated iPhones Vulnerable to New DarkSword Attack, SQ Magazine.

• Apple warns iPhones at high risk of hacking without latest iOS update, Ynetnews.