The Hacker News

🛑 Apple is sending #iPhone Lock Screen alerts warning users about active web-based attacks targeting outdated iOS. Coruna and DarkSword exploit kits target older iOS via compromised sites, expanding risk beyond targeted attacks. 🔗 Read → https://thehackernews.com/2026/03/apple-sends-lock-screen-alerts-to.html

🚨 Coruna turns a 2023 #iOS espionage exploit into a broader attack kit. Kaspersky confirms it reuses and evolves the Triangulation kernel exploit, now updated for newer chips and iOS versions and still actively maintained. Now bundled into 23 exploits across 5 chains and used beyond targeted ops, it shows #iPhone exploitation is scaling. 🔗 How Coruna evolved and is being deployed → https://thehackernews.com/2026/03/coruna-ios-kit-reuses-2023.html

🚨 WARNING - A new #iOS exploit kit, DarkSword, has been active since late 2025 across multiple threat groups. It targets #iPhone on iOS 18.4–18.7, chaining zero-days to gain full access and rapidly extract data—files, messages, credentials, and crypto wallets—then wipe traces within minutes. 🔗 DarkSword details here → https://thehackernews.com/2026/03/darksword-ios-exploit-kit-uses-6-flaws.html

⚡ Apple backports CVE-2023-43010 fix after the WebKit flaw was used in the Coruna #iPhone exploit kit. It allows memory corruption via malicious web content. Fix now covers iOS 15.8.7 & 16.7.15 devices, including iPhone 6s, 7, 8 & X. 🔗 Read → https://thehackernews.com/2026/03/apple-issues-security-updates-for-older.html

⚡NATO has cleared #iPhone and iPad to handle classified information. The approval relies on built-in iOS and iPadOS security—no custom hardening or special software required. Germany’s BSI had already cleared the devices for classified government use. 🔗 Details on NATO approval → https://thehackernews.com/2026/03/threatsday-bulletin-redis-rce-ddr5-bot.html#nato-clears-consumer-iphones-and-ipads

🛑 ALERT: Google uncovered an #iPhone exploit kit called Coruna containing 23 iOS exploits targeting versions 13–17.2.1. The framework fingerprints devices and automatically loads the matching WebKit exploit chain. Researchers say it moved from #surveillance vendors to nation-state operators and later cybercrime groups. 🔗 Exploit chains, campaigns, and malware payload details → https://thehackernews.com/2026/03/coruna-ios-exploit-kit-uses-23-exploits.html