FlagThis — Daily Cybersecurity Intelligence Briefing

The proliferation of the Coruna exploit kit and the associated DarkSword full-chain exploit represents a systemic escalation in mobile threat capabilities. Utilizing a sequence of zero-day vulnerabilities, including CVE-2026-21385, DarkSword facilitates WebKit exploitation, kernel-level privilege escalation, and sandbox escapes to achieve total device compromise on iOS. Originally deployed by boutique actors, the kit has transitioned to a commoditized model, enabling multiple global threat groups to conduct unauthorized data exfiltration and maintain persistence on high-value targets. This shift highlights a critical transition toward widely distributed, high-end offensive capabilities targeting modern iOS security mitigations.