Date: 10/19/2026
Severity: High
Summary
Researcher observed renewed Coruna-like and DarkSword iOS exploit kit activity originating from Chinese-language webpages, including sites associated with video distribution and adult-content lures. The attack chain uses injected iframes to redirect visitors to domains hosting exploit kits that target vulnerable, outdated iOS versions. The activity highlights the risks of drive-by exploitation against unpatched mobile devices; the report notes that current iOS versions are not vulnerable to these exploit kits.
Indicators of Compromise (IOC) List
Domains/Urls | 8itk5k-3n302ot5eo.store aiask0912.com auukk.com abn3l8febkskxmce0tat6ide.store cashbus.org c2uge9o8jb9b8dk1ty84q56.org f3dlvbk5edo5s57.icu jskdljk.top static.flyfun.cc |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "f3dlvbk5edo5s57.icu" or url like "f3dlvbk5edo5s57.icu" or siteurl like "f3dlvbk5edo5s57.icu" or domainname like "8itk5k-3n302ot5eo.store" or url like "8itk5k-3n302ot5eo.store" or siteurl like "8itk5k-3n302ot5eo.store" or domainname like "aiask0912.com" or url like "aiask0912.com" or siteurl like "aiask0912.com" or domainname like "jskdljk.top" or url like "jskdljk.top" or siteurl like "jskdljk.top" or domainname like "abn3l8febkskxmce0tat6ide.store" or url like "abn3l8febkskxmce0tat6ide.store" or siteurl like "abn3l8febkskxmce0tat6ide.store" or domainname like "auukk.com" or url like "auukk.com" or siteurl like "auukk.com" or domainname like "static.flyfun.cc" or url like "static.flyfun.cc" or siteurl like "static.flyfun.cc" or domainname like "c2uge9o8jb9b8dk1ty84q56.org" or url like "c2uge9o8jb9b8dk1ty84q56.org" or siteurl like "c2uge9o8jb9b8dk1ty84q56.org" or domainname like "cashbus.org" or url like "cashbus.org" or siteurl like "cashbus.org" |
Reference:
iOS Exploit Kit Resurgence