iOS exploit kits reach iPhones through hidden website frames.

An iOS exploit kit uses browser vulnerabilities to attack an iPhone when it visits a page. On compromised websites, an injected hidden frame sends the browser to an external router or exploit loader while the site's visible content stays on screen.

compromised website
  -> hidden frame loads an external page
  -> router checks the device and iOS version
  -> dispatcher fetches and runs selected modules
  -> browser enters the exploit chain

Hidden frames load code outside the visible page

Coruna sits behind a one-pixel frame marked aria-hidden. That frame opens another external frame, whose page imports the dispatcher.

Another router creates frames with zero width and height, positions them off-screen and disables pointer events. It reads the iPhone, iPad or iPod OS version from the user agent and loads separate frame routes. A browser-storage lock suppresses retries after a child frame signals that its entry code ran.

A fake wallet download site sends iPhones to two kits

Exploit routers also sit on sites the attackers build. tokeonptcket[.]com copies the download page of TokenPocket, a crypto wallet. Mobile visitors are sent to a six-character subdomain that changes every two hours. Android visitors get an APK of about 195 MB, and iPhone visitors get /download.html, which loads lp-router.js from www[.]caik[.]my.

The router reads an affiliate code such as AG00021 from the page, so one copy serves many sellers, and checks the iOS version:

• iOS 13 to 17 opens a hidden frame on a /static/ path that serves Coruna.
• iOS 18 opens a hidden frame on /go/<channel code>, a module loader the router itself labels "DarkSword PE". DarkSword is a separate kit for iOS 18.4 to 18.7, first described in March 2026 (The Hacker News).

The router keeps the screen awake and waits up to 120 seconds for the frame to report eval_ok. After three failed attempts it loads the exploit page in the main window. The /go/ page shows a Chinese TRX energy rental page as its cover.

A landing-page router we first captured on 4 November 2026 also checks the device against an allowlist it calls a gray gate. It then loads a page it calls gooll in a hidden frame. Its routing module sends iOS 13 to 17 to Coruna and iOS 18.5 to 18.6.2 to DarkSword. A route it calls C10 is meant for iOS 19 and later, which since Apple's jump in numbering means iOS 26, but the server we captured on 5 November 2026 had C10 switched off and nothing behind it. When DarkSword fails, the loader falls back to Coruna, and it reports each route to its panel.

The kit behind it is for sale. Two Chinese source-code markets list Coruna, DarkSword and C10 together as Caishen iOS C2 V2. Its lighter router, lp-router.js, ran on 72 sites between 4 October and 5 November 2026 and names its builder as Telegram @caishenge. The C10 code for iOS 26 sat on two Cloudflare Pages sites in August and September, built on offsets with placeholder hashes.

Routers now cover more of the version range

Two router builds we first matched on 6 November 2026 show where the kits are going. One, next-chain, picks from four chains by iOS version: Coruna up to 17.2.1, one it calls SilkPath for 17.2.2 to 18.3, DarkSword for 18.4 to 18.7.2, and one it calls GhostWave for 18.7.3 and iOS 26. Its server can override the choice. The DarkSword page has the details.

The other is an external mode for lp-router.js. A landing page loads the router from the operator's host with its own channel code, and we matched that block on 40 sites in two days. The Coruna page shows the tag.

Version checks select the loader route

The remote-module loader extracts the iPhone OS version from navigator.userAgent. It fetches JavaScript files as text, saves each response in window.modules under its filename and evaluates an entry module. A retrying variant uses cache: 'no-store' and waits for the downloads to finish before running the entry.

Coruna uses an obfuscated obChTK dispatcher with hash-keyed modules and salted resource filenames. Alongside it, a recurring beacon reads the visitor's public IP address and an OS/version description, then posts them with a campaign value and the executing frame's hostname to an IP-sync endpoint.

What we see across infected sites

Month	New sites
September	0
October	450
November so far	322

Of the 657 sites captured since 25 September, 597 ran WordPress.

Of the 0 sites recaptured at least 25 days after their first match, 0 still served iOS exploit-kit code (0%).

Finding and removing the hidden frames

Preserve the page source, rendered DOM and frame request chain. Check for:

• one-pixel or zero-size frames loading unfamiliar external pages
• aria-hidden, off-screen positioning and disabled pointer events on those frames
• user-agent checks for iPhone OS versions before remote scripts load
• JavaScript fetched as text, stored in window.modules and passed to eval
• an obChTK dispatcher, hash-named modules or recurring IP-sync requests
• parent/child messages and browser-storage keys that suppress repeat loads

Remove the injected frames and their loaders, then restore changed page templates and site files from trusted sources. Review CMS, hosting and deployment access, rotate affected credentials and clear caches. Test the original path with an iPhone user agent and inspect the frame requests again.