iOS exploit kits and app hardening: are your controls keeping up?

TL;DR: Coruna and DarkSword style iOS exploit kits can hook app functions, bypass sandbox protections, and extract passwords, tokens, Keychain items, and files from targeted apps, according to Guardsquare research, while its testing found 17 wallet apps failed to detect common hooking and injection techniques. The lesson for mobile security teams is that runtime compromise turns bearer secrets, trust checks, and static storage into high-value failure points.

NHIMG editorial — based on content published by Guardsquare: Can Your App Survive Coruna and DarkSword iOS Exploits?

By the numbers:

• The Coruna exploit kit included 23 exploits and targeted iOS versions up to 17.2.1.
• DarkSword infected iOS versions 18.4 through 18.7 via malicious websites before escaping the WebKit sandbox.

Questions worth separating out

Q: What breaks when mobile apps rely on bearer tokens after a device compromise?

A: Bearer tokens become replayable once an attacker can hook the app or intercept memory at runtime.

Q: Why do iOS exploit kits make mobile identity assurance harder?

A: They attack the trust layer between the operating system and the app, where authentication and transaction data are actually handled.

Q: How do teams know if mobile app hardening is actually working?

A: Look for reduced success in reverse engineering, fewer successful tampering attempts and cleaner separation between legitimate user traffic and suspicious API requests.

Practitioner guidance

• Harden runtime integrity checks Instrument high-value functions to detect hooking, injection, and trust-store tampering, then send those signals to backend risk engines for token revocation or step-up controls.
• Replace reusable bearer tokens Move critical mobile flows toward device-bound asymmetric signing in the Trusted Execution Environment so a stolen secret cannot be replayed from another device.
• Reduce predictable secret-handling paths Avoid using the same standard iOS functions for every sensitive operation, and pre-encrypt values before they reach public APIs or storage layers.

What's in the full article

Guardsquare's full post covers the operational detail this post intentionally leaves for the source:

• Experiment setup showing how Roothide and SSLKillSwitch were used to test hooking detection across targeted apps
• Step-by-step hardening patterns for anti-hooking checks, including multi-layered detection and backend alerting
• Implementation guidance for device binding, Keychain handling, and certificate pinning in mobile apps
• Version-rotation tactics that force attackers to rebuild hooks after each release

👉 Read Guardsquare's analysis of Coruna, DarkSword, and iOS app hardening →

iOS exploit kits and app hardening: are your controls keeping up?

Explore further

View Full Forum →  |  NHI Foundation Course →