PP124: How Coruna, DarkSword, and Other Exploits Slice Up Apple iPhones

Drew Connery-Murray interviews Akili Akerage, a mobile security expert, to discuss two major iOS exploit frameworks: Karuna and DarkSword. Karuna originated from Operation Triangulation in 2023, reportedly developed by U.S. government contractors at an estimated cost of $30-40 million. It contains 23 different exploits and was observed progressing from government surveillance in 2025 to use against Ukraine by Russians, then to Chinese criminal organizations by end of 2025. DarkSword, containing 6 exploits (3 of which are zero-days), was first observed in 2025 targeting Saudi Arabia and Turkish users before being leaked across 126 GitHub repositories.

Both frameworks operate through one-click watering hole attacks on legitimate websites. They exploit WebKit vulnerabilities using just-in-time (JIT) JavaScript compilation to bypass sandboxes and achieve kernel-level code execution. Once at kernel level, they inject payloads into privileged processes, dump and decrypt the device's keychain to steal credentials, and operate entirely in memory, making detection extremely difficult. Karuna performs cleanup operations after compromise, while DarkSword focuses on broad espionage collection including messages, photos, WhatsApp conversations, and keychains.

Akerage explains how exploits leak from government contractors through insider threats (like L3 Harris employee Peter Williams, who sold 8 exploits for $1.3 million), external theft, and nation-state trading with criminal organizations. He emphasizes that these threats now converge into "Darkuna," which achieves full kernel compromise in three minutes, survives device reboots (unlike its predecessors), improves virtualization detection, and was identified on 17,000 different domains as of the podcast's recording.

Regarding Apple's security posture, Akerage argues that while Apple built a strong walled garden historically, the company cannot keep pace with threat evolution and needs to open APIs to security vendors similar to how macOS has the Endpoint Security Framework. Lockdown mode, while useful, severely reduces device functionality and must be enabled before exploitation occurs.

Akerage outlines seven critical defense recommendations: (1) establish baseline visibility across all devices, not just executives; (2) audit and restrict mobile device access based on identity and permissions; (3) implement MAM and MDM; (4) build a loaner device bench for rapid replacement of compromised devices; (5) establish executive protection programs prioritizing CISOs and global admins as top targets; (6) monitor identity activity; and (7) adopt new technology solutions like mobile EDR, behavioral analysis tools, and AI-augmented security rather than relying on signature-based detection. He emphasizes that AI is accelerating both attack and defense capabilities, and that old security practices anchored to pre-AI methodologies are insufficient.