DarkSword/Coruna Open Directory Finding Report - Censys

Open directories exposing the DarkSword/Coruna iOS exploitation and wallet-theft platform reveal a commercial exploitation-as-a-service operation with live C2 telemetry, multiple wallet-targeting modules, staged payloads, and a production server containing victim mnemonics and device loot. The activity spans several operators, including a China-based actor, with ongoing iOS 26 development and new CVE leads, underscoring a high-severity, multi-faceted threat with potential widespread impact.