Characterization of the Coruna DarkSword campaign

The 2026-10-31 roundtable evidence is specific enough to correct the campaign description now: it records a reproduced browser-delivered and fingerprinted DarkSword chain, version-specific exploitation on iOS 18.6.2, module delivery, command-and-control activity, and named exfiltration.

In contrast, the possible CoreAudio route was found in an operator registry but not validated on a device.

Continuing to call Coruna a confirmed no-click campaign would therefore preserve a broader claim than the available evidence supports, while delaying the correction would obscure the concrete web-delivered behaviors responders can investigate.

Targeted individuals using version-matched iOS 18 devices face the documented web-delivered DarkSword path.

On iOS 18.6.2, the reproduced consequences include module delivery, command-and-control traffic, exfiltration of NoteStore.sqlite, and collection of an inventory of 214 installed applications.

Operators and incident responders responsible for iOS 18.6.2 devices need to investigate those specific behaviors without assuming every DarkSword capability was used.

Individuals using versions before iOS 18.4.1 are separately relevant to the report of targeted exploitation of CVE-2025-31200, although this packet does not establish the exact affected builds or its relationship to Coruna.

Security leaders and public communicators are also affected because labeling the activity “confirmed no-click” overstates an entry path that has not been validated on a device.

Support — Nadia El-Sayed’s mobile-security contribution says the reproduced DarkSword attack begins with browser delivery and fingerprinting against version-matched iOS 18 devices.

It also says the CoreAudio entry appeared in an operator registry but was not verified on a device, directly supporting removal of the confirmed no-click label.

Support — Halil Öztürkci’s moderator synthesis says Zimperium demonstrated version-specific exploitation on iOS 18.6.2, followed by module delivery, command-and-control traffic, and exfiltration of NoteStore.sqlite and an inventory of 214 installed applications.

Evidence gap — the evidence audit found these accounts mutually consistent but noted that the underlying primary reports and direct citation links were not included, preventing independent verification from this packet alone.

On 2026-10-31, Nadia El-Sayed’s mobile-security contribution distinguished the reproduced browser-delivered DarkSword chain from a CoreAudio entry found in an operator registry but not verified on a device.

Halil Öztürkci’s moderator synthesis connected the reproduced path to iOS 18.6.2, module delivery, command-and-control traffic, and exfiltration of NoteStore.sqlite plus an inventory of 214 installed applications.

The decision scout converted that distinction into an operational correction: retain the targeted, web-delivered characterization and remove the claim of confirmed no-click exploitation.

The evidence audit found the two accounts consistent but identified the absence of their underlying primary reports. The boundary review found the narrower characterization safe for public use.

The linker found no prior Decision Record to update, and the arbiter selected a new record because the reproduced web chain supports correction while the no-click claim lacks on-device validation.