Topic starter
18/08/2026 3:00 pm
TL;DR: Coruna and DarkSword style iOS exploit kits can hook app functions, bypass sandbox protections, and extract passwords, tokens, Keychain items, and files from targeted apps, according to Guardsquare research, while its testing found 17 wallet apps failed to detect common hooking and injection techniques. The lesson for mobile security teams is that runtime compromise turns bearer secrets, trust checks, and static storage into high-value failure points.
Editorial analysis by NHI Mgmt Group, based on content published by Guardsquare: “Can Your App Survive Coruna and DarkSword iOS Exploits?”.
Key questions
Q: What breaks when mobile app trust is enforced only on the device?
A: Device-only enforcement is visible to the attacker and can be bypassed, patched, or stripped out in a repackaged app.
Q: Why do stolen mobile tokens and passwords create such a large identity risk?
A: They create risk because they are reusable outside the device and often remain valid until explicitly revoked.
Q: How do teams know if mobile app hardening is actually working?
A: Look for reduced success in reverse engineering, fewer successful tampering attempts and cleaner separation between legitimate user traffic and suspicious API requests.
Practitioner guidance
- Harden runtime integrity checks Detect hooking, dynamic library injection, and jailbreak state early, then send those events to your backend so you can revoke sessions or step up transaction controls.
- Replace reusable bearer secrets Move away from passwords and long-lived tokens where possible, and prefer device-bound signing flows that keep private keys in the Trusted Execution Environment.
- Encrypt sensitive data before system calls Do not hand raw secrets to standard helper functions or storage APIs if you can pre-encrypt them inside application logic first.
Bottom line: Mobile exploit kits now target the moment secrets are used, not just where they are stored.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:40 pm
Runtime trust is now the real control boundary for mobile identity. Once exploit kits can hook functions inside the app, traditional trust assumptions about the operating system and sandbox stop being reliable. The issue is not only malware presence but whether authentication, certificate checks, and secret retrieval still mean what the app thinks they mean. For practitioners, mobile assurance has to shift toward runtime integrity and response.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
A question worth separating out:
Q: Should organisations prioritise device-bound credentials over stronger local storage?
A: Yes, when the application handles high-value identity data or financial transactions. Better local storage helps at rest, but it does not stop runtime interception once the secret is loaded for use. Device-bound credentials reduce portability, limit replay, and make compromise dependent on continued control of the device itself.
👉 Read our full editorial: iOS exploit kits are bypassing app trust and stealing live data