Web threats / iOS exploit kits
Coruna iOS exploit kit
Coruna is an iPhone exploit kit loaded through hidden website frames. We have matched its dispatcher and beacon code on 772 sites since 3 October.
Coruna in numbers
Since 3 October, the first Coruna match in our records, counted on 12 November 2026. How we count.
| Sites with Coruna code | 772 |
|---|---|
| Sites with a match in the last 30 days | 770 |
| New sites in October | 450 |
| Still serving it when recaptured at least 25 days later | 0 of 0 sites (0%) |
| Sites running WordPress (captured since 25 September) | 91% |
A one-pixel frame opens the dispatcher
Coruna is an exploit kit targeting iPhones running iOS 13.0 through 17.2.1. Google Threat Intelligence Group's Coruna report describes its browser fingerprinting and selection of an exploit chain for the device.
The injected frame in a compromised page is one pixel wide and high, with aria-hidden="true" and tabindex="-1". It loads hxxps://js[.]apiforxwork[.]com/qqtime/qqtime.html. That wrapper opens hxxps://js[.]apiforxwork[.]net/qqtime/qqtime.html, where a script imports the dispatcher.
Routers pair Coruna with DarkSword
Coruna also reaches iPhones from sites the attackers build. A fake TokenPocket wallet download site runs a router that sends iOS 13 to 17 to Coruna and iOS 18 to DarkSword. The iOS exploit kits page follows that route.
A server at 154.222.16[.]220 does the same behind a fake Cloudflare check branded for OKX. When its DarkSword stages fail, the loader falls back to Coruna, and both kits report to one panel. Its router keeps a third route, C10, for iOS 26, and on 5 November 2026 that route was switched off with nothing behind it.
A compromised WordPress shop we captured on 10 November 2026 hosts both kits itself, in /wp-includes/js/analystic/assets/js/. Its gate sends iPhones below iOS 18 to a Coruna stage in that folder, 49554fde7424c31c.js, and the dispatcher sets the same folder as the base it fetches modules from. The DarkSword page has the gate.
A lighter router from the same kit, lp-router.js, sent iOS 13 to 17 to Coruna on 72 sites between 4 October and 5 November 2026. Two Chinese source-code markets sell the three chains together as a kit called Caishen iOS C2 V2. The DarkSword page has the listings.
An external mode for other people's sites
On 6 and 7 November 2026 we matched a block of HTML on 40 sites that loads the router from someone else's server. The tag carries data-coruna-external="1", a data-channel-code and the router host as data-coruna-base. Next to it, the page opens off-screen frames to /static/<32 hex>.html?c=<channel> on that host, the Coruna entry for iOS 13 to 17. The router sees the external flag and skips its own Coruna frame.
So one router host serves many landing pages, each with its own channel code. The router hosts we have seen are www.chainlk[.]com, web.iosapp[.]shop and xlysapp[.]com. One landing page, tgmessaging[.]com, is a fake Telegram download page using the channel master_global.
A separate router, next-chain, keeps Coruna for iOS 13 to 17.2.1 and adds two more chains for later versions. The DarkSword page has its version map.
obChTK resolves the modules
The script decodes a Base64 dispatcher and installs it as globalThis.obChTK. Its module methods include hPL3On, ZKvD0e, po3QmN and eW4__H. Hash keys identify modules, and salted filenames determine the resources it fetches and runs.
The dispatcher runs in the external frame, so the first-party page source shows only the injected iframe.
The beacon repeats its IP lookup and POST
The appended beacon fetches the visitor's public IP address as text and builds an OS/version description from the user agent. It posts JSON to hxxps://1x8gmjbdq3tepgr[.]icu/api/ip-sync/sync with channelCode, ip, deviceVersion and domain fields.
domain comes from window.location.hostname. In this chain it reads js[.]apiforxwork[.]net, where the frame executes. The timer starts after two seconds and repeats every ten seconds, performing the IP lookup on each pass. A separate timer attempts to reload the parent every two minutes.
What we see
| Month | New sites |
|---|---|
| September | 0 |
| October | 450 |
| November so far | 322 |
Among successful captures since 25 September, 597 of 657 Coruna sites ran WordPress. Of the 0 sites recaptured at least 25 days after their first match, 0 still served Coruna (0%).
Checking a Coruna injection
Keep the first-party HTML and each document and script loaded through its frames. Look for:
- a one-pixel
aria-hiddenframe loading an externalqqtime/qqtime.htmlpage - a wrapper that opens another frame on a different host
globalThis.obChTKand its hash-keyed module dispatch- JSON POSTs to
/api/ip-sync/syncwith the beacon's field names - recurring IP lookups and parent-reload timers
globalThis.obChTKloaded from a folder under/wp-includes/js/that WordPress does not ship- a script tag with
data-coruna-externalordata-channel-code, and off-screen frames to/static/<32 hex>.html?c=
Remove the frame injection and restore the changed template or HTML from a trusted deployment. Review CMS, hosting and deployment access, rotate affected credentials and clear cached copies. Retest the reported path and follow every frame request it makes.