Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
DarkSword and Coruna are separate iPhone exploit kits, and both have been linked to attacks on older iOS versions. Wallet data was among the information DarkSword collected, while analysts characterized Coruna as more directly focused on cryptocurrency theft. Lookout identified DarkSword command-and-control (C2) servers during its investigation, but the reporting available through October 9, 2026 does not verify that those servers are still live.
What are DarkSword and Coruna?
They are distinct exploit kits: toolsets that use software vulnerabilities to compromise devices. Google Threat Intelligence Group described Coruna on March 3, 2026, and DarkSword on March 19, 2026. Google reported that DarkSword spread among different threat actors in a way that resembled the earlier Coruna case, and said the actor UNC6353 had used both. That overlap does not make them the same kit. (Google’s Coruna analysis; Google’s DarkSword analysis)
Both were reported as full exploit chains, but their reported components, version ranges, and campaign profiles differ. Google counted six vulnerabilities in DarkSword and named three final-stage malware families—GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER. Its Coruna report described five full iOS exploit chains containing 23 exploits. Those figures count reported technical components, not victims or successful infections.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Do DarkSword and Coruna target cryptocurrency wallets?
Wallet data was within DarkSword’s collection scope, but that alone does not establish that every deployment stole cryptocurrency or that wallet theft was the kit’s sole purpose. Lookout reported rapid collection of sensitive data, including cryptocurrency wallets. iVerify characterized DarkSword as a broader surveillance and intelligence-gathering operation that also looked for wallets. In contrast, iVerify described Coruna as appearing mostly aimed at cryptocurrency theft. These are analyst characterizations of reported campaigns, not proof of the objective or outcome of every use. (Lookout’s findings; iVerify’s findings)
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
iVerify estimated in its March 18, 2026 announcement that as many as 270 million devices were still running affected versions. That was a potential exposure estimate at publication, not a confirmed infection or victim count. The reviewed reports do not establish an independent named victim count for either kit.
Which iOS versions were reported as affected?
Published ranges differ by kit and by report. They describe the versions associated with researchers’ analyses or observed campaigns; they should not be read as a guarantee that every device in a range was compromised.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Kit | Reported iOS range | What the reporting says |
|---|---|---|
| DarkSword | Google: iOS 18.4 through 18.7. Lookout and iVerify: campaign descriptions through iOS 18.6.2. | Google’s March 19, 2026 analysis gives the broader range; Lookout and iVerify describe observed attacks or supported versions through 18.6.2. The reports do not make these figures interchangeable. (Google; Lookout; iVerify) |
| Coruna | Google: iOS 13.0 through 17.2.1. | This is the range in Google’s March 3, 2026 report. Google said Coruna was not effective against the latest iOS at the time of that report; that statement is time-bound, not a current device-compatibility check. (Google) |
What is known about DarkSword’s C2 infrastructure?
A command-and-control server is infrastructure malware can contact to receive instructions or transmit information. Lookout said its researchers identified DarkSword C2 servers and analyzed malicious infrastructure during their investigation. Google documented delivery domains and said it added identified delivery domains to Safe Browsing. These findings establish that researchers identified infrastructure in connection with the investigation; they do not establish that it remains operational now. Neither report, as reviewed, verifies that DarkSword C2 servers were still live on October 9, 2026. A domain listed in an older report should not be treated as a current live indicator without a fresh, reliable check.
Google reported DarkSword use dating back to at least November 2025 and described campaigns involving actors in Saudi Arabia, Turkey, Malaysia, and Ukraine. Its report discusses multiple actors and delivery domains, not a single fixed infrastructure set that can be assumed to remain active.
Rank #3
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How do the reported campaigns differ?
Google’s March 3, 2026 account traces Coruna through several phases: initial use by a surveillance-vendor customer, later targeting of Ukrainian users by the suspected Russian espionage cluster UNC6353, and subsequent broad campaigns by financially motivated UNC6691. These descriptions concern reported use over time; they do not establish that every campaign had the same operator or goal. (Google’s Coruna analysis)
In its March 19, 2026 report, Google described DarkSword as adopted by multiple threat actors and cited campaigns in four countries. Lookout emphasized rapid data collection and exfiltration, while iVerify stressed the broader surveillance profile. The different analyst descriptions help explain why wallet collection should not be equated with a single universal motive. (Google; Lookout; iVerify)
Quick Recap
Best Value
- 【Powerful 130dB Self Defense Emergency Alarm】This personal alarm emits a 130dB ultra-loud siren that can be heard up to 600 feet away, effectively scaring off attackers and drawing attention from people nearby. Ideal for women, kids, elderly, night runners, and anyone walking alone—an essential safety keychain for daily protection.
- 【USB-C Rechargeable & Long-Lasting Performance】Built-in rechargeable battery supports up to 2 hours of continuous siren use and 1 year of standby time. Charging via USB-C cable (universal & fast), no need for frequent battery replacement. Low-power reminder ensures the alarm is always ready for emergencies.
- 【Portable Keychain Design for Easy Carrying】Lightweight & compact with a sturdy keychain clip, easy to attach to bags, purses, backpacks, belts, or keys. Take it anywhere—commuting, traveling, camping, school, or night walks. Discreet but powerful security on the go.
- 【LED Strobe Light & SOS Emergency Function】Equipped with a bright LED strobe light that works as a flashlight for night use and an SOS emergency signal in danger. One-button control for quick activation: pull the pin to trigger alarm + strobe light, maximize your safety in dark or emergency situations.
- 【4-Pack Value Set & Wide Application】Package includes 4 personal alarms (Aqua/Black/Pink/White) + 4 keychains. Perfect for family, friends, and daily sharing. FCC/CE certified, safe and reliable. If the alarm sounds weak, simply recharge it via USB-C for full power again.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How can iPhone users reduce the risk?
- Install the latest iOS update available for the specific device. Google said all DarkSword vulnerabilities in its analysis were patched with iOS 26.3, though most had been patched earlier. Lookout’s March 18, 2026 guidance specified iOS 18.7.3 or later, or iOS 26.3 or later. Those are dated recommendations; check the update offered for the device rather than assuming a March 2026 version remains the latest or is available for every model. Google also recommended updating against Coruna. (Google on DarkSword; Lookout; Google on Coruna)
- If you cannot update, consider Lockdown Mode. Google recommends it as an added protection when updating is not possible, including in its Coruna guidance. It is not a substitute for installing available security updates and should not be treated as a guarantee that every component of either kit is blocked. (Google’s Coruna protection guidance; Google’s DarkSword analysis)
- Take a suspected compromise seriously. If the phone may have visited a malicious watering-hole page, treat it as a potential security incident. If cryptocurrency is involved, use a separate, trusted device to review account security and seek reputable incident-response guidance. The cited reporting does not identify a consumer antivirus app, accessory, or repair tool as a confirmed remedy for an already compromised device.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute
