Androidelizados_SupportChannel 

Androidelizados_SupportChannel  pinned «https://www.youtube.com/watch?v=beQNC4YByYA»

https://www.youtube.com/watch?v=beQNC4YByYA

xCientos de millones de iPhones pueden ser hackeados con solo visitar una web https://hipertextual.com/seguridad/darksword-exploit-hackeo-iphone-ios-18/

Un detalle que llama la atención del reporte es que los hackers dejaron el código de DarkSword completamente expuesto, sin ofuscar. Existen comentarios explicativos en inglés que incluso incluían el nombre de la herramienta, accesibles para cualquiera que visitara las webs infectadas. "Cualquiera que tomara manualmente las distintas partes del exploit podría ponerlas en su propio servidor web y empezar a infectar teléfonos. Es así de simple", advirtió Matthias Frielingsdorf, cofundador e investigador de iVerify. "Está todo bien documentado. Es demasiado fácil." Más de 270 millones de dispositivos quedaron expuestos Al igual que vimos en Coruna, esta herramienta se aprovecha de móviles que no han instalado la versión más reciente del sistema operativo. El grupo de investigadores reveló que DarkSword afecta a dispositivos que ejecutan desde iOS 18.4 hasta iOS 18.7. Según los datos de Apple, estas versiones todavía se ejecutan en cerca de 270 millones de iPhones en todo el mundo. La buena noticia es que Apple ya parcheó todas las vulnerabilidades con el lanzamiento de iOS 26. La tecnológica también publicó actualizaciones de emergencia para modelos antiguos que no pueden ejecutar la versión más reciente del sistema operativo. Si todavía no actualizas tu móvil, puedes hacerlo desde Ajustes > General > Actualización de Software. Los expertos también sugieren activar el Modo de Aislamiento (o Modo Hermético) del iPhone, una protección adicional que bloquea ciertas funciones al navegar o usar los servicios y aplicaciones. Este modo está dirigido a personas que podrían ser víctimas de ataques dirigidos.

Según el Grupo de Inteligencia de Amenazas de Google, DarkSword ha sido utilizado desde al menos noviembre de 2025 por múltiples actores, incluyendo vendedores de spyware y grupos de espionaje patrocinados por estados. Se han detectado campañas activas contra objetivos en Arabia Saudita, Turquía, Malasia y Ucrania. El caso más documentado involucra a UNC6353, un grupo de espionaje ruso que utilizó la herramienta Coruna en webs de Ucrania, incluido un servidor del gobierno. En los casos de Turquía y Malasia, Google identificó el uso de DarkSword por parte de clientes de PARS Defense, una empresa turca de seguridad y vigilancia.

Qué datos puede robar DarkSword en el iPhone Una vez que el usuario visita una web infectada, los hackers pueden robar una cantidad impresionante de datos. Entre ellos se encuentran mensajes de texto, historial de llamadas, contraseñas del WiFi, historial de navegación y de ubicación y la billetera de criptomonedas. También tendrán acceso a los registros de iMessage, WhatsApp y Telegram, datos de Calendario y Notas, así como tu información de Apple Health.

A unas semanas de que Google descubriera un kit para hackear el iPhone, una nueva herramienta ha salido a la luz. Investigadores de Google, iVerify y Lookout revelaron la existencia de DarkSword, una técnica que permite vulnerar los dispositivos iOS con solo visitar una web. Los expertos afirman que esta herramienta ya ha sido utilizada en campañas de espionaje y que podría afectar a cientos de millones de usuarios. De acuerdo con múltiples publicaciones de los investigadores, DarkSword es un exploit que funciona como un ataque de tipo watering hole (o abrevadero), una técnica en la que los hackers infectan sitios web legítimos para comprometer los dispositivos de sus víctimas. En este caso, cualquier iPhone vulnerable solo necesita cargar la página para que el atacante tenga acceso al móvil. A diferencia del spyware convencional, DarkSword no instala ningún archivo en el dispositivo. La herramienta adopta técnicas de malware sin archivo que consisten en secuestrar los procesos del sistema operativo para robar datos.

https://blog.elhacker.net/2026/03/iphones-pueden-ser-hackeados-con-solo.html

Researchers investigating Coruna uncovered related infrastructure linked to Russian actor UNC6353, including a similar domain used in attacks on compromised Ukrainian sites, even government ones. Malicious iframes loaded scripts to fingerprint devices and target specific iOS versions. Further analysis revealed a new exploit chain, later named DarkSword, discovered in late 2025 through joint research by Lookout, iVerify, and Google, confirming a distinct and evolving threat. While it initially appeared that this may be another site distributing Coruna, upon closer inspection of the our researchers found that the iframe loads a javascript file called rce_loader.js, which is largely responsible for fingerprinting devices visiting the compromised site in order to determine whether to route the devices to the iOS exploit chain. However, the script was looking for iOS devices with OS versions 18.4 or 18.6.2, which are iOS versions that are not susceptible to the exploit chains used in Coruna. darksword exploit An excerpt from rce_loader.js showing that devices with specific iOS versions are routed to different scripts for exploitation based on the version. – Source Lookout report Recognizing that this was a new threat, our researchers analyzed the code and began capturing all of the stages of the exploits. According to Lookout, the actor behind the exploit, UNC6353, remains a largely unknown group but has used advanced iOS exploit chains in watering hole attacks on Ukrainian websites. Likely well-funded, it appears to rely on third-party or brokered exploits, possibly linked to Russian ecosystems. The group targets both intelligence and financial data, including crypto assets, suggesting dual motives. Its infrastructure is limited but shows deep access to compromised sites. Poor obfuscation and signs of AI-assisted code suggest limited in-house expertise. Overall, UNC6353 is assessed as a capable yet not highly sophisticated actor, potentially a Russia-aligned proxy blending espionage with cybercrime. Google GTIG experts found multiple actors using DarkSword since November 2025, and believes other surveillance vendors or threat groups are likely using the exploit chain as well.

The framework uses fingerprinting to detect device type and iOS version, then loads the appropriate WebKit RCE exploit and pointer authentication bypass. One recovered exploit, CVE-2024-23222, was later patched in iOS 17.3. Government-backed attackers used the same framework in Ukrainian watering hole attacks, delivering multiple RCE exploits to select iPhone users. Later, Chinese scam websites deployed the full Coruna kit, dropping the same exploits via hidden iFrames on fake financial and crypto sites. GTIG collected hundreds of samples covering all five exploit chains and observed debug versions exposing internal exploit names, confirming the kit’s internal name as Coruna. The Coruna exploit kit relies on a highly engineered framework that links all components through shared utilities and custom loaders. It avoids devices in Lockdown Mode or private browsing, derives resource URLs from a hard-coded cookie, and delivers WebKit RCE and PAC bypasses in clear form. After exploitation, a binary loader deploys encrypted, compressed payloads disguised as .min.js files, tailored to specific chips and iOS versions. In total, the kit includes 23 exploits covering iOS 13 through 17.2.1, with advanced mitigation bypasses and reusable modules for defeating memory and kernel protections. At the end of the chain, a stager called PlasmaLoader injects into a root daemon and deploys a financially focused payload. The malware scans for crypto wallets, backup phrases, and banking data, exfiltrating sensitive information and loading additional modules from command-and-control servers. It targets numerous cryptocurrency apps, uses encrypted communications, and falls back on a custom domain generation algorithm seeded with “lazarus” to maintain persistence. Google published Indicators of Compromise (IOCs) and Yara rules for this exploit. Recently, Lookout Threat Labs discovered a new iOS exploit kit called DarkSword that has been used since late 2025 by multiple threat actors, including surveillance vendors and likely nation-state actors. The toolkit enables full-chain attacks to steal sensitive data from Apple devices and has been observed in campaigns targeting countries such as Saudi Arabia, Turkey, Malaysia, and Ukraine. The exploit chain relies on six vulnerabilities, three used as zero-days, to achieve full device compromise: CVE-2025-31277 – JavaScriptCore memory corruption (CVSS: 8.8) CVE-2026-20700 – dyld PAC bypass (CVSS: 8.6) (zero-day) CVE-2025-43529 – JavaScriptCore memory corruption (CVSS: 8.8) (zero-day) CVE-2025-14174 – ANGLE memory corruption (CVSS: 8.8) (zero-day) CVE-2025-43510 – iOS kernel memory issue (CVSS: 8.6) CVE-2025-43520 – iOS kernel memory corruption (CVSS: 8.6) Together, these flaws enable full-chain exploitation and complete control of targeted iOS devices. DarkSword targets iPhones running iOS 18.4–18.7 and has been used by the suspected Russian-linked group UNC6353 against Ukrainian targets. It allows attackers to steal sensitive data, including credentials and crypto wallet information, then quickly exfiltrates it in a “hit-and-run” approach before cleaning traces. The exploits appear to be linked to Coruna exploits, DarkSword enables near full device access with minimal user interaction, showing how advanced exploits are now available on a secondary market to a wider range of threat actors. “DarkSword aims to extract an extensive set of personal information including credentials from the device and specifically targets a plethora of crypto wallet apps, hinting at a financially motivated threat actor.” reads the report published by Lookout. “Notably, DarkSword appears to take a “hit-and-run” approach by collecting and exfiltrating the targeted data from the device within seconds or at most minutes followed by cleanup.”

Apple warns that outdated iPhones are vulnerable to Coruna and DarkSword exploit kits and urges users to update iOS. Apple has warned that iPhones running outdated iOS versions are at risk from exploit kits like Coruna and DarkSword. These attacks use malicious web content to trigger infection chains that can steal sensitive data. Users are strongly advised to update their devices to stay protected. “Security researchers recently identified web-based attacks that target out-of-date versions of iOS through malicious web content. For example, if you’re using an older version of iOS and were to click a malicious link or visit a compromised website, the data on your iPhone might be at risk of being stolen.” reads Apple’s advisory. “We thoroughly investigated these issues as they were found and released software updates as quickly as possible for the most recent operating system versions to address vulnerabilities and disrupt such attacks.” Keeping the iPhone updated is the most effective way to stay protected from threats like Coruna and DarkSword. Devices running the latest iOS versions are not vulnerable, and Lockdown Mode also blocks these attacks, even on older systems, though updates are still strongly recommended. If your iPhone runs an older iOS version, take action: • Devices on iOS 15 to iOS 26 are already protected if fully updated • Apple released updates on March 11, 2026, to extend protection to iOS 15 and 16 devices • Devices on iOS 13 or 14 must upgrade to iOS 15 and install a Critical Security Update • Safari’s Safe Browsing feature helps block known malicious domains by default Updating ensures user data remains secure. In February, Google’s Threat Intelligence Group identified a powerful new iOS exploit kit called Coruna (also known as CryptoWaters) that targets Apple iPhones running iOS versions 13.0 through 17.2.1. The kit includes five full exploit chains and a total of 23 exploits.

“Why does the exploit need to check for iOS 17.2 and newer CPUs if the targeted vulnerabilities were fixed in iOS 16.5 beta 4? The answer can be found by examining other exploits: they are all based on the same source code.” continues the report. “The only difference is in the vulnerabilities they exploit, so these checks were added to support the newer exploits and appeared in the older version after recompilation.” The launcher handles post-exploitation tasks. Instead of re-running the exploit, it reuses existing kernel access created earlier to read and write memory. It removes traces of the attack, selects a target process, injects a stager, and executes it to deploy the final malware. This streamlined approach makes the attack more efficient and stealthy once initial access is gained. “Originally developed for cyber-espionage purposes, this framework is now being used by cybercriminals of a broader kind, placing millions of users with unpatched devices at risk.” concludes the report. “Given its modular design and ease of reuse, we expect that other threat actors will begin incorporating it into their attacks. We strongly recommend that users install the latest security updates as soon as possible, if they have not already done so.” In mid-March, Lookout Threat Labs discovered a new iOS exploit kit called DarkSword that has been used since late 2025 by multiple threat actors, including surveillance vendors and likely nation-state actors. The toolkit enables full-chain attacks to steal sensitive data from Apple devices and has been observed in campaigns targeting countries such as Saudi Arabia, Turkey, Malaysia, and Ukraine. DarkSword targets iPhones running iOS 18.4–18.7 and has been used by the suspected Russian-linked group UNC6353 against Ukrainian targets. It allows attackers to steal sensitive data, including credentials and crypto wallet information, then quickly exfiltrates it in a “hit-and-run” approach before cleaning traces. The exploits appear to be linked to Coruna exploits, DarkSword enables near full device access with minimal user interaction, showing how advanced exploits are now available on a secondary market to a wider range of threat actors.