Topic starter
06/11/2026 6:36 pm
TL;DR: Open directories on five hosts exposed the full DarkSword/Coruna iOS exploit-and-harvest platform, including live C2, staging code and wallet-theft modules, plus evidence of ongoing operator use and a 75-account control-plane roster, according to Censys. The exposure shows how commercial exploit kits turn infrastructure sprawl into operational risk, not just malware visibility.
Editorial analysis by NHI Mgmt Group, based on content published by Censys: “DarkSword/Coruna Open Directory Finding Report”.
Key questions
Q: How do attackers steal crypto wallet recovery phrases from mobile devices?
A: Attackers usually steal recovery phrases by reading them from the clipboard, screenshots, camera images, notification previews, or files copied into notes and cloud backups on the phone.
Q: What should teams do first when mobile malware exposes wallet recovery material?
A: Teams should first assume the wallet access path is compromised, then isolate the device, revoke related sessions or approvals where possible, and move assets to a new wallet created on a clean device.
Q: How do control planes in commercial malware operations affect response?
A: Commercial malware control planes centralise tasking, victim selection, payload updates, exfiltration, and operator access to stolen data.
Practitioner guidance
- Inventory exposed operator infrastructure Classify exposed hosts by function, including staging, telemetry, panel and payload distribution, so detections and disruption actions follow the attack service architecture rather than isolated domains.
- Treat wallet recovery material as a credential Review whether photos, notes, backups and password managers can expose BIP39 recovery phrases or equivalent wallet restoration material, then assign stronger handling to those artefacts.
- Separate mobile malware telemetry from payload delivery Build monitoring that distinguishes beacon servers, staging directories and admin panels, because the same operator may change domains while reusing the same workflow.
Bottom line: The exposed DarkSword/Coruna infrastructure showed a commercial theft operation with staged delivery, live telemetry and wallet-harvesting modules.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
DarkSword/Coruna shows that malware infrastructure is now an identity governance problem, not just a detection problem. The exposed directories did not merely reveal binaries. They exposed how the operator provisions channels, stages payloads, assigns agents and harvests recovery material, which is the operational shape of a criminal service. For identity teams, that means the control question shifts from sample blocking to understanding how access, control and delegation are organised across the attack service.
A question worth separating out:
Q: What signs suggest a mobile theft kit is operating as a service?
A: A mobile theft kit is operating as a service when the tooling is packaged for multiple operators, with a web console, modular payloads, repeatable deployment, and subscription-like access to stolen data or remote control features. Other signs include branded builds, customer support channels, affiliate-style provisioning, and frequent updates to evade detection.
👉 Read our full editorial: Open DarkSword infrastructure exposed a commercial iOS theft kit