Open DarkSword infrastructure exposed a commercial iOS theft kit

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Censys's report: Open directories exposed a live DarkSword/Coruna iOS theft platform, including C2 infrastructure, staged payloads and wallet-harvesting modules.

Why it matters: This matters because exposed operator infrastructure reveals how mobile theft kits are built, staged and controlled, which helps defenders hunt for similar command, delivery and exfiltration patterns before victims lose funds or recovery material.

Context

The security gap here is not simply malware presence, but exposed operator infrastructure that makes a private theft platform observable from the outside. When command servers, staging directories and panel files are left reachable, defenders can inspect how the operation is organised, what it targets, and which parts are still active.

For iOS-focused theft operations, the important question is not whether an exploit exists in isolation. It is how the exploit chain, payload distribution, wallet-targeting modules and controller workflows fit together into a repeatable criminal service, which is why infrastructure exposure matters as much as sample analysis.

Key questions

Q: How do attackers steal crypto wallet recovery phrases from mobile devices?

A: Attackers usually steal recovery phrases by reading them from the clipboard, screenshots, camera images, notification previews, or files copied into notes and cloud backups on the phone. They may also harvest them through fake wallet prompts, overlay screens, or malicious keyboard and accessibility abuse. Once obtained, a recovery phrase gives direct control of the wallet and any assets tied to it.

Q: What should teams do first when mobile malware exposes wallet recovery material?

A: Teams should first assume the wallet access path is compromised, then isolate the device, revoke related sessions or approvals where possible, and move assets to a new wallet created on a clean device. They should preserve device and app artefacts for forensics, because mobile malware may have copied the recovery phrase, seed backups, or transaction-signing prompts before detection.

Q: How do control planes in commercial malware operations affect response?

A: Commercial malware control planes centralise tasking, victim selection, payload updates, exfiltration, and operator access to stolen data. For response, that means defenders should look for command infrastructure, remote configuration changes, and coordinated theft activity rather than treating each infected handset as an isolated case. Disrupting the control plane can break the operators’ ability to steer the campaign.

Q: What signs suggest a mobile theft kit is operating as a service?

A: A mobile theft kit is operating as a service when the tooling is packaged for multiple operators, with a web console, modular payloads, repeatable deployment, and subscription-like access to stolen data or remote control features. Other signs include branded builds, customer support channels, affiliate-style provisioning, and frequent updates to evade detection.

Technical breakdown

How the DarkSword delivery chain is staged

The platform separates exploitation, staging and harvesting into distinct layers. One host serves packaged release material, another serves live beaconing and telemetry, and a third exposes the admin surface that coordinates agents, devices and wallet-related tasks. That separation lets operators update components independently while keeping the public-facing C2 and delivery flow functional. It also makes the kit easier to operate as a service because different operators can reuse the same base tooling with their own infrastructure and targets.

Practical implication: Map each exposed host to its role in the delivery chain so you can prioritise shutdown, sinkholing or monitoring by function rather than by domain alone.

Wallet-harvesting modules and recovery phrase theft

The harvesting side of the kit is built to target crypto wallet applications and surrounding user artefacts. The modules inject into running apps, pull data from the device, and search photos and Notes for BIP39 recovery phrases, which are the seed words that can restore wallet access. That combination matters because a compromise does not need to steal an active session if the operator can recover the wallet outright from locally stored recovery material. The theft logic is therefore aimed at both app memory and user content. See the Crypto Wallet Security Guide.

Practical implication: Treat any device that has held wallet recovery material as a high-value endpoint and assume local content exposure can be as damaging as app-level compromise.

Operator panels as a service control plane

The exposed admin panel is more than a dashboard. It functions as a service control plane with agent assignment, device tracking, command approval, exfiltration handling and wallet-focused workflows. The panel also reflects a reseller model, which is a common pattern in commercialised intrusion tooling because it lets the operator delegate campaigns without giving every customer the same level of access. In practice, that creates a layered trust model where the infrastructure itself becomes part of the threat surface.

Practical implication: Hunt for reseller-style control patterns, because shared administration often leaves operational artefacts that are easier to detect than the payloads themselves.

Threat narrative

Attacker objective: The operator aims to turn compromised iOS devices into repeatable wallet-theft infrastructure that can recover seed phrases, exfiltrate device data and monetise account access.

1. Entry occurred through a malicious iOS watering-hole flow that delivered exploit code and pulled the victim into the operator-controlled browser session.
2. Credential and recovery material were harvested when the payload searched device content, photos and Notes for wallet seed phrases and other sensitive artefacts.
3. Escalation followed when the exploit chain reached higher device privileges and injected into SpringBoard and targeted wallet processes.
4. Impact was theft of wallet access material, device loot and commandable telemetry that supported repeated harvesting against victims over time.

Breaches seen in the wild

• iOS apps leaking hard-coded secrets: Cybernews found 71% of 156,080 iOS apps leak hard-coded secrets, with open cloud storage and Firebase databases exposing user data.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

DarkSword/Coruna shows that malware infrastructure is now an identity governance problem, not just a detection problem. The exposed directories did not merely reveal binaries. They exposed how the operator provisions channels, stages payloads, assigns agents and harvests recovery material, which is the operational shape of a criminal service. For identity teams, that means the control question shifts from sample blocking to understanding how access, control and delegation are organised across the attack service.

Exposed wallet recovery material creates a distinct identity failure mode: recovery material becomes the real credential. When operators search photos and Notes for BIP39 phrases, the compromise is not limited to app state or browser sessions. It becomes a portable identity takeover path that can outlive the original device session. That is why wallet recovery handling belongs in the same governance conversation as secrets management and privileged access.

Commercialised exploit kits create lifecycle problems across the operator chain. The agent/reseller model, control-plane roster and separate operator infrastructure show that the threat is not a single actor with a single panel. It is a managed access ecosystem with changing ownership, reused tooling and distributed responsibility. Practitioners should read this as a warning that offboarding and revocation matter even in adversary infrastructure, because stale control surfaces extend the life of the operation.

Infrastructure exposure shortens defender visibility into the kit’s real operating model. The open directories exposed staging, telemetry, wallet targeting and panel workflows in one place, which is the kind of artefact that lets defenders build higher-confidence detections and disruption plans. That visibility is valuable because the same tooling can be repackaged, rehosted or resold quickly, so the durable signal is the workflow, not the domain.

Read next: Breach and Attack Simulation (BAS) Guide

What this signals

Managed mobile theft platforms are increasingly recognisable by their workflow, not their domains. When the same operator can swap hosts and keep the same staging logic, control plane and harvest modules, defenders need detections that follow the service pattern instead of chasing one-off infrastructure. That makes workflow-level hunting more durable than domain blocking alone.

Recovery phrases are the decisive asset in wallet compromise. Once BIP39 material is exposed, the attacker does not need to keep the original phone online or preserve the active session. The governance implication is straightforward: identity and access programmes must treat wallet recovery material as a high-risk credential class, not as ordinary user content.

For practitioners

• Inventory exposed operator infrastructure Classify exposed hosts by function, including staging, telemetry, panel and payload distribution, so detections and disruption actions follow the attack service architecture rather than isolated domains.
• Treat wallet recovery material as a credential Review whether photos, notes, backups and password managers can expose BIP39 recovery phrases or equivalent wallet restoration material, then assign stronger handling to those artefacts. See the Crypto Wallet Security Guide.
• Separate mobile malware telemetry from payload delivery Build monitoring that distinguishes beacon servers, staging directories and admin panels, because the same operator may change domains while reusing the same workflow.
• Hunt for reseller-style control planes Look for agent quotas, per-operator channels, approval workflows and grouped exfiltration endpoints, since those are common indicators of a commercial intrusion service.
• Prioritise devices that stored wallet artefacts Escalate response for devices that have held recovery phrases, wallet screenshots or local notes containing seed words, because the blast radius extends beyond active sessions.

Key takeaways

• The exposed DarkSword/Coruna infrastructure showed a commercial theft operation with staged delivery, live telemetry and wallet-harvesting modules.
• The most damaging evidence was not only the malware itself but the recovery phrases, loot directories and control-plane data recovered from the operator environment.
• Defenders should focus on workflow-level detection and on protecting wallet recovery material as credential-grade data, because that is what turns a device compromise into lasting account loss.

Related NHI Mgmt Group resources: Breach and Attack Simulation (BAS) Guide · Crypto Wallet Security Guide · Account Recovery Planning Guide · Hacked Social Media or Email Account Recovery Guide

Key terms

• BIP39 Recovery Phrase: A BIP39 Recovery Phrase is a human-readable sequence of words used to derive a cryptocurrency wallet’s private keys. It follows the BIP39 standard, so the same phrase can recreate the wallet on any compatible application or device, which makes its secrecy equivalent to direct wallet control.
• Command-and-control: Command-and-control is the communication channel an attacker uses to issue instructions to malware and receive results back from a compromised host. For XWorm, the channel is encrypted and used for session management, payload delivery, surveillance, and modular expansion of capabilities after compromise.
• SpringBoard: SpringBoard is the graphical launcher and home screen manager on Apple mobile operating systems. It controls app launching, icon layout, multitasking UI, notifications, and much of the user-facing system shell, making it a central process in device operation and policy enforcement.
• Watering Hole: A watering hole is an attack in which criminals compromise a legitimate website or service that the intended victims already use, then serve malicious code or redirects from that trusted location. The method relies on the victim’s normal browsing path rather than direct phishing, so trust in the site becomes part of the attack.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.