DarkSword/Coruna Open Directory Finding Report
- Published by
- Censys
- Published
- 7 Oct 2026
- Indicators
- 1 verified
The report
Executive summary Key judgments Background: DarkSword and Coruna DarkSword is an exploit chain for iOS that Google Threat Intelligence Group (GTIG) first documented publicly in March 2026. The chain attacks WebKit and JavaScriptCore to gain code execution, escapes the browser sandbox, escalates to kernel privileges, and injects into SpringBoard, the iOS process that manages app […]
Read the full analysis: DarkSword/Coruna Open Directory Finding Report (Censys).
Indicators
Malware C
- 66ds[.]lol
Defanged so they cannot be clicked by mistake: replace [.] with a dot. Shared hosting and CDN addresses named in the report are left out on purpose, so blocking these does not break legitimate sites.
How this is tracked
EncryptLayer intelligence, A.R.P. Syndicate’s open threat feed, reviews each indicator against the published report before adding it (#7). This page is generated from that record and the report’s own title and summary; nothing is rewritten.