{
  "name": "IoCs (Indicators of Compromise) for the Coruna iOS iPhone Web Malware Client Side Exploits Serving Web Malware Exploitation Kit",
  "slug": "iocs-indicators-of-compromise-for-the-coruna-ios-iphone-web-malware-client-side-exploits-serving-web-malware-exploitation-kit",
  "description": "The intelligence details indicators of compromise for the Coruna iOS iPhone web malware exploitation kit. It provides MD5, SHA-1, and SHA-256 hashes for detected JavaScript payloads. The analysis lists numerous active domains serving the malware, including specific URLs delivering client-side exploits. The campaign involves a wide network of malicious domains and URLs targeting iOS devices. The extensive list of compromised and malicious infrastructure demonstrates the scale of this exploitation kit's operations, highlighting the ongoing threat to iPhone users through web-based attacks.",
  "published": "2026-03-16T22:26:57+00:00",
  "created_at": "2026-03-16T22:26:57+00:00",
  "modified_at": "2026-03-17T00:44:22+00:00",
  "created_at_opencti": "2026-03-16T22:26:57+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2026-03-16",
    "client-side exploits",
    "coruna",
    "coruna ios iphone web malware",
    "exploitation kit",
    "indicators of compromise",
    "ios",
    "iphone",
    "web malware"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "http://b27.icu/9e7e6ec78463c5e6bdee39e9f3f33d6fa296ea72.js"
      },
      {
        "id": "",
        "name": "http://goanalytics.xyz/88k4ez/group.html"
      },
      {
        "id": "",
        "name": "http://bestcryptocurrency.top"
      },
      {
        "id": "",
        "name": "http://sf2bisx5nhdkygn3l.xyz"
      },
      {
        "id": "",
        "name": "http://4kgame.us"
      },
      {
        "id": "",
        "name": "http://65sse.668ddf.cc"
      },
      {
        "id": "",
        "name": "http://6zvjeulzaw5c0mv.xyz"
      },
      {
        "id": "",
        "name": "http://b27.icu/7994d095b1a601253c206c45c120a80c4c0f3736.js"
      },
      {
        "id": "",
        "name": "http://lddx3z2d72aa8i6.xyz/group.html"
      },
      {
        "id": "",
        "name": "http://gem88.ac"
      },
      {
        "id": "",
        "name": "http://sadjd.mijieqi.cn/group.html"
      },
      {
        "id": "",
        "name": "http://b27.icu"
      },
      {
        "id": "",
        "name": "http://b27.icu/ee164f985cd9a7786dad6ca922b2de314dde9231.js"
      },
      {
        "id": "",
        "name": "http://gunbet.ac"
      },
      {
        "id": "",
        "name": "http://anygg.liquorfight.com/88k4ez/group.html"
      },
      {
        "id": "",
        "name": "http://rlau616jc7a7f7i.xyz"
      },
      {
        "id": "",
        "name": "http://share.4u.game"
      },
      {
        "id": "",
        "name": "http://lsnngjyu9x6vcg0.xyz"
      },
      {
        "id": "",
        "name": "http://b27.icu/8d646979cf7f3e5e33a85024b6cf2bc81a6c5812.js"
      },
      {
        "id": "",
        "name": "http://w2a315.tubeluck.com"
      },
      {
        "id": "",
        "name": "http://sj9ioz3a7y89cy7.xyz"
      },
      {
        "id": "",
        "name": "http://4u.game/group.html"
      },
      {
        "id": "",
        "name": "http://tubeluck.com"
      },
      {
        "id": "",
        "name": "http://uawwydy3qas6ykv.xyz"
      },
      {
        "id": "",
        "name": "http://appstoreconn.com/xmweb/group.html"
      },
      {
        "id": "",
        "name": "http://t7c.icu/group.html"
      },
      {
        "id": "",
        "name": "http://lk4x6x2ejxaw2br.xyz"
      },
      {
        "id": "",
        "name": "http://share.4u.game/group.html"
      },
      {
        "id": "",
        "name": "http://b27.icu/2839f4ff4e23733e6ba132e639ce96d36d23c6b6.js"
      },
      {
        "id": "",
        "name": "http://eg2bjo5x5r8yjb5.xyz"
      },
      {
        "id": "",
        "name": "http://8fn4957c5g986jp.xyz"
      },
      {
        "id": "",
        "name": "http://7ff.online/group.html"
      },
      {
        "id": "",
        "name": "http://b38w09ecdejfqsf.xyz"
      },
      {
        "id": "",
        "name": "http://res54allb.xn--xkrsa0078bd6d.com/group.html"
      },
      {
        "id": "",
        "name": "http://gemwin.ac"
      },
      {
        "id": "",
        "name": "http://y4w.icu/group.html"
      },
      {
        "id": "",
        "name": "http://appstoreconn.com"
      },
      {
        "id": "",
        "name": "http://gqjs3ra34lyuvzb.xyz"
      },
      {
        "id": "",
        "name": "http://xittgveqaufogve.xyz"
      },
      {
        "id": "",
        "name": "http://ai-scorepredict.com"
      },
      {
        "id": "",
        "name": "http://b27.icu/feeee5ddaf2659ba86423519b13de879f59b326d.js"
      },
      {
        "id": "",
        "name": "http://goanalytics.xyz"
      },
      {
        "id": "",
        "name": "http://4u.game"
      },
      {
        "id": "",
        "name": "http://7uspin.us/group.html"
      },
      {
        "id": "",
        "name": "http://so5083.tubeluck.com"
      },
      {
        "id": "",
        "name": "http://land.bingo777.now/88k4ez/group.html"
      },
      {
        "id": "",
        "name": "http://fxrhcnfwxes90q.xyz/group.html"
      },
      {
        "id": "",
        "name": "http://ios.teegrom.top/tuiliu/group.html"
      },
      {
        "id": "",
        "name": "http://b27.icu/5aed00feae0b817db276377c1306e5fcae67cb95.js"
      },
      {
        "id": "",
        "name": "http://bestcryptocurrency.top/details/group.html"
      },
      {
        "id": "",
        "name": "http://ajskbnrs.xn--jor0b302fdhgwnccw8g.com/gogo/list.html"
      },
      {
        "id": "",
        "name": "http://65sse.668ddf.cc/tuiliu/group.html"
      },
      {
        "id": "",
        "name": "http://w2a315.tubeluck.com/static/goindex/tuiliu/group.html"
      },
      {
        "id": "",
        "name": "http://ios.teegrom.top"
      },
      {
        "id": "",
        "name": "http://k96.icu/group.html"
      },
      {
        "id": "",
        "name": "http://osec2.668ddf.cc/tuiliu/group.html"
      },
      {
        "id": "",
        "name": "http://i.binaner.com/group.html"
      },
      {
        "id": "",
        "name": "http://7ff.online"
      },
      {
        "id": "",
        "name": "http://pepeairdrop01.com/static/analytics.html"
      },
      {
        "id": "",
        "name": "http://n49.top"
      },
      {
        "id": "",
        "name": "http://anygg.liquorfight.com"
      },
      {
        "id": "",
        "name": "http://b27.icu/d9a260b1c2f63ab5e5aac4261d8a0be5a8b64da0.js"
      },
      {
        "id": "",
        "name": "http://xmmfrkq9oat1daq.xyz"
      },
      {
        "id": "",
        "name": "http://ol67el6pxg03ad7.xyz"
      },
      {
        "id": "",
        "name": "http://b27.icu/25bb1b38371a67e977ed534d251d95b6f07aff90.js"
      },
      {
        "id": "",
        "name": "http://fxrhcnfwxes90q.xyz"
      },
      {
        "id": "",
        "name": "http://dd9l7e6ghme8pbk.xyz"
      },
      {
        "id": "",
        "name": "http://b27.icu/b903659316e881e624062869c4cf4066d7886c28.js"
      },
      {
        "id": "",
        "name": "http://b27.icu/group.html"
      },
      {
        "id": "",
        "name": "http://iphonex.mjdqw.cn"
      },
      {
        "id": "",
        "name": "http://k96.icu"
      },
      {
        "id": "",
        "name": "http://dbgopaxl.com/static/goindex/tuiliu/group.html"
      },
      {
        "id": "",
        "name": "http://sbet.ac"
      },
      {
        "id": "",
        "name": "http://hfteigt3kt0sf3z.xyz"
      },
      {
        "id": "",
        "name": "http://sj9ioz3a7y89cy7.xyz/list.html"
      },
      {
        "id": "",
        "name": "http://7p.game/group.html"
      },
      {
        "id": "",
        "name": "http://i9-bet.ac"
      },
      {
        "id": "",
        "name": "http://cy8.top"
      },
      {
        "id": "",
        "name": "http://lddx3z2d72aa8i6.xyz"
      },
      {
        "id": "",
        "name": "http://so5083.tubeluck.com/static/goindex/group.html"
      },
      {
        "id": "",
        "name": "http://ddus17.com/tuiliu/group.html"
      },
      {
        "id": "",
        "name": "http://pen0axt0u476duw.xyz"
      },
      {
        "id": "",
        "name": "http://res54allb.xn--xkrsa0078bd6d.com"
      },
      {
        "id": "",
        "name": "http://ztvnhmhm4zj95w3.xyz"
      },
      {
        "id": "",
        "name": "http://cdn.uacounter.com"
      },
      {
        "id": "",
        "name": "http://spin7.icu"
      },
      {
        "id": "",
        "name": "http://hui4tbh9uv9x4yi.xyz"
      },
      {
        "id": "",
        "name": "http://game.7p.game"
      },
      {
        "id": "",
        "name": "http://98a.online/group.html"
      },
      {
        "id": "",
        "name": "http://iphonex.mjdqw.cn/tuiliu/group.html"
      },
      {
        "id": "",
        "name": "http://land.bingo777.now"
      },
      {
        "id": "",
        "name": "http://yvgy29glwf72qnl.xyz"
      },
      {
        "id": "",
        "name": "http://mkkku.com/static/analytics.html"
      },
      {
        "id": "",
        "name": "http://98a.online"
      },
      {
        "id": "",
        "name": "http://7p.game"
      },
      {
        "id": "",
        "name": "http://ddus17.com"
      },
      {
        "id": "",
        "name": "http://dbgopaxl.com"
      },
      {
        "id": "",
        "name": "http://spin7.icu/group.html"
      },
      {
        "id": "",
        "name": "http://kanav.blog/group.html"
      },
      {
        "id": "",
        "name": "http://land.777bingos.xyz/88k4ez/group.html"
      },
      {
        "id": "",
        "name": "http://bet247.ac"
      },
      {
        "id": "",
        "name": "http://v2gmupm7o4zihc3.xyz"
      },
      {
        "id": "",
        "name": "http://pepeairdrop01.com"
      },
      {
        "id": "",
        "name": "http://n49.top/group.html"
      },
      {
        "id": "",
        "name": "http://b27.icu/055c5ab6028f7c0a3f8970975c332fe4417b054c.js"
      },
      {
        "id": "",
        "name": "http://goodcryptocurrency.top"
      },
      {
        "id": "",
        "name": "http://ose.668ddf.cc"
      },
      {
        "id": "",
        "name": "http://land.77bingos.com/88k4ez/group.html"
      },
      {
        "id": "",
        "name": "http://cryptocurrencyworld.top/details/group.html"
      },
      {
        "id": "",
        "name": "http://ajskbnrs.xn--jor0b302fdhgwnccw8g.com"
      },
      {
        "id": "",
        "name": "http://y4w.icu"
      },
      {
        "id": "",
        "name": "http://gdvynopz3pa0tik.xyz"
      },
      {
        "id": "",
        "name": "http://roy2tlop2u.xyz"
      },
      {
        "id": "",
        "name": "http://sadjd.mijieqi.cn"
      },
      {
        "id": "",
        "name": "http://7fun.icu"
      },
      {
        "id": "",
        "name": "http://cdn.uacounter.com/stat.html"
      },
      {
        "id": "",
        "name": "http://xfal48cf0ies7ew.xyz"
      },
      {
        "id": "",
        "name": "http://7fun.icu/group.html"
      },
      {
        "id": "",
        "name": "http://btrank.top"
      },
      {
        "id": "",
        "name": "http://3v5w1km5gv.xyz/group.html"
      },
      {
        "id": "",
        "name": "http://goodcryptocurrency.top/details/group.html"
      },
      {
        "id": "",
        "name": "http://cy8.top/group.html"
      },
      {
        "id": "",
        "name": "http://share.7p.game"
      },
      {
        "id": "",
        "name": "http://26a.online"
      },
      {
        "id": "",
        "name": "http://land.77bingos.com"
      },
      {
        "id": "",
        "name": "http://ose.668ddf.cc/tuiliu/group.html"
      },
      {
        "id": "",
        "name": "http://h4k.icu"
      },
      {
        "id": "",
        "name": "http://ai-scorepredict.com/static/analytics.html"
      },
      {
        "id": "",
        "name": "http://zcjdlb5ubkhy41u.xyz"
      },
      {
        "id": "",
        "name": "http://7uspin.us"
      },
      {
        "id": "",
        "name": "http://4kgame.us/group.html"
      },
      {
        "id": "",
        "name": "http://cryptocurrencyworld.top"
      },
      {
        "id": "",
        "name": "http://btrank.top/tuiliu/group.html"
      },
      {
        "id": "",
        "name": "http://binancealliancesintro.com/group.html"
      },
      {
        "id": "",
        "name": "http://vvri8ocl4t3k8n6.xyz"
      },
      {
        "id": "",
        "name": "http://seven7.vip"
      },
      {
        "id": "",
        "name": "http://26a.online/group.html"
      },
      {
        "id": "",
        "name": "http://t7c.icu"
      },
      {
        "id": "",
        "name": "http://osec2.668ddf.cc"
      },
      {
        "id": "",
        "name": "http://land.777bingos.xyz"
      },
      {
        "id": "",
        "name": "http://dd9l7e6ghme8pbk.xyz/group.html"
      },
      {
        "id": "",
        "name": "http://2s3b3rknfqtwwpo.xyz"
      },
      {
        "id": "",
        "name": "http://seven7.vip/group.html"
      },
      {
        "id": "",
        "name": "http://o08h5rhu2lu1x0q.xyz"
      },
      {
        "id": "",
        "name": "http://b27.icu/d715f1db179d73edcc180a8e376b3c17a09e389a.js"
      },
      {
        "id": "",
        "name": "http://3v5w1km5gv.xyz"
      },
      {
        "id": "",
        "name": "http://share.7p.game/group.html"
      },
      {
        "id": "",
        "name": "http://taisunwin.ac"
      },
      {
        "id": "",
        "name": "http://binancealliancesintro.com"
      },
      {
        "id": "",
        "name": "http://xjslbdt9jdijn15.xyz"
      },
      {
        "id": "",
        "name": "http://kanav.blog"
      },
      {
        "id": "",
        "name": "http://b27.icu/2cea19382f2b211e8caf609bc0bacc98f2557543.js"
      },
      {
        "id": "",
        "name": "http://i.binaner.com"
      },
      {
        "id": "",
        "name": "http://mkkku.com"
      },
      {
        "id": "",
        "name": "http://h4k.icu/group.html"
      },
      {
        "id": "",
        "name": "01d6e008795b73a29359f92856bfeafef8210711c8a95f1cd2ab257f0a7492ba"
      },
      {
        "id": "",
        "name": "8ac1175307ec784f367a0b21cd474c3bfc97d7b238ac4300ac5766ef45e63abb"
      },
      {
        "id": "",
        "name": "ea01377836441013d22112f4e5a7139c5ed0ebcf942d0836b9c088413e25692f"
      },
      {
        "id": "",
        "name": "c167b5f5e150f0ba855c038b4cf0dc7084c77ae2a70ba6248762e11f272c2ec1"
      },
      {
        "id": "",
        "name": "52c510ecc3eed32f6f35c699474cb719c90482a2a4b37169cc478d2dbc0b8c89"
      }
    ],
    "malware": [
      {
        "id": "16c47bb6-f377-4bcc-bf0a-d083efeff62c",
        "name": "Coruna iOS iPhone Web Malware",
        "slug": "coruna-ios-iphone-web-malware"
      }
    ],
    "attack_patterns": [
      {
        "id": "16e4fc82-7c0b-4d1a-b784-b804b4df26dc",
        "name": "T1204.001"
      },
      {
        "id": "9322d33b-00c1-4f99-9f1a-a33d93c0dac2",
        "name": "T1059.007"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "6c8f8a40-2746-4a37-86bd-81e82afa6e62",
        "name": "T1190"
      },
      {
        "id": "28548897-8b18-4095-97e8-1732f52e9316",
        "name": "T1102.003"
      },
      {
        "id": "b9eab970-53dd-4977-9a26-c4fe566e422d",
        "name": "T1133"
      },
      {
        "id": "fe6f2946-a01e-460c-9636-8c48b45dd0e6",
        "name": "T1189"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "i9-bet.ac"
      },
      {
        "id": "",
        "name": "goodcryptocurrency.top"
      },
      {
        "id": "",
        "name": "2s3b3rknfqtwwpo.xyz"
      },
      {
        "id": "",
        "name": "gemwin.ac"
      },
      {
        "id": "",
        "name": "v2gmupm7o4zihc3.xyz"
      },
      {
        "id": "",
        "name": "hui4tbh9uv9x4yi.xyz"
      },
      {
        "id": "",
        "name": "ose.668ddf.cc"
      },
      {
        "id": "",
        "name": "ztvnhmhm4zj95w3.xyz"
      },
      {
        "id": "",
        "name": "sj9ioz3a7y89cy7.xyz"
      },
      {
        "id": "",
        "name": "ai-scorepredict.com"
      },
      {
        "id": "",
        "name": "roy2tlop2u.xyz"
      },
      {
        "id": "",
        "name": "btrank.top"
      },
      {
        "id": "",
        "name": "pen0axt0u476duw.xyz"
      },
      {
        "id": "",
        "name": "fxrhcnfwxes90q.xyz"
      },
      {
        "id": "",
        "name": "gunbet.ac"
      },
      {
        "id": "",
        "name": "dbgopaxl.com"
      },
      {
        "id": "",
        "name": "seven7.vip"
      },
      {
        "id": "",
        "name": "3v5w1km5gv.xyz"
      },
      {
        "id": "",
        "name": "7fun.icu"
      },
      {
        "id": "",
        "name": "lk4x6x2ejxaw2br.xyz"
      },
      {
        "id": "",
        "name": "bet247.ac"
      },
      {
        "id": "",
        "name": "cdn.uacounter.com"
      },
      {
        "id": "",
        "name": "rlau616jc7a7f7i.xyz"
      },
      {
        "id": "",
        "name": "lsnngjyu9x6vcg0.xyz"
      },
      {
        "id": "",
        "name": "yvgy29glwf72qnl.xyz"
      },
      {
        "id": "",
        "name": "sadjd.mijieqi.cn"
      },
      {
        "id": "",
        "name": "iphonex.mjdqw.cn"
      },
      {
        "id": "",
        "name": "hfteigt3kt0sf3z.xyz"
      },
      {
        "id": "",
        "name": "ddus17.com"
      },
      {
        "id": "",
        "name": "xmmfrkq9oat1daq.xyz"
      },
      {
        "id": "",
        "name": "gqjs3ra34lyuvzb.xyz"
      },
      {
        "id": "",
        "name": "xfal48cf0ies7ew.xyz"
      },
      {
        "id": "",
        "name": "vvri8ocl4t3k8n6.xyz"
      },
      {
        "id": "",
        "name": "sf2bisx5nhdkygn3l.xyz"
      },
      {
        "id": "",
        "name": "gdvynopz3pa0tik.xyz"
      },
      {
        "id": "",
        "name": "kanav.blog"
      },
      {
        "id": "",
        "name": "i.binaner.com"
      },
      {
        "id": "",
        "name": "ios.teegrom.top"
      },
      {
        "id": "",
        "name": "sbet.ac"
      },
      {
        "id": "",
        "name": "anygg.liquorfight.com"
      },
      {
        "id": "",
        "name": "res54allb.xn--xkrsa0078bd6d.com"
      },
      {
        "id": "",
        "name": "taisunwin.ac"
      },
      {
        "id": "",
        "name": "land.77bingos.com"
      },
      {
        "id": "",
        "name": "4kgame.us"
      },
      {
        "id": "",
        "name": "lddx3z2d72aa8i6.xyz"
      },
      {
        "id": "",
        "name": "xittgveqaufogve.xyz"
      },
      {
        "id": "",
        "name": "zcjdlb5ubkhy41u.xyz"
      },
      {
        "id": "",
        "name": "uawwydy3qas6ykv.xyz"
      },
      {
        "id": "",
        "name": "gem88.ac"
      },
      {
        "id": "",
        "name": "mkkku.com"
      },
      {
        "id": "",
        "name": "b38w09ecdejfqsf.xyz"
      },
      {
        "id": "",
        "name": "ol67el6pxg03ad7.xyz"
      },
      {
        "id": "",
        "name": "pepeairdrop01.com"
      },
      {
        "id": "",
        "name": "6zvjeulzaw5c0mv.xyz"
      },
      {
        "id": "",
        "name": "binancealliancesintro.com"
      },
      {
        "id": "",
        "name": "osec2.668ddf.cc"
      },
      {
        "id": "",
        "name": "so5083.tubeluck.com"
      },
      {
        "id": "",
        "name": "7uspin.us"
      },
      {
        "id": "",
        "name": "bestcryptocurrency.top"
      },
      {
        "id": "",
        "name": "land.777bingos.xyz"
      },
      {
        "id": "",
        "name": "eg2bjo5x5r8yjb5.xyz"
      },
      {
        "id": "",
        "name": "appstoreconn.com"
      },
      {
        "id": "",
        "name": "xjslbdt9jdijn15.xyz"
      },
      {
        "id": "",
        "name": "tubeluck.com"
      },
      {
        "id": "",
        "name": "dd9l7e6ghme8pbk.xyz"
      },
      {
        "id": "",
        "name": "65sse.668ddf.cc"
      },
      {
        "id": "",
        "name": "land.bingo777.now"
      },
      {
        "id": "",
        "name": "w2a315.tubeluck.com"
      },
      {
        "id": "",
        "name": "goanalytics.xyz"
      },
      {
        "id": "",
        "name": "cryptocurrencyworld.top"
      }
    ]
  },
  "external_refs": [
    "https://otx.alienvault.com/pulse/69b891c1dc6a9f2f666e3cc5",
    "https://securityboulevard.com/2026/03/iocs-indicators-of-compromise-for-the-coruna-ios-iphone-web-malware-client-side-exploits-serving-web-malware-exploitation-kit/"
  ]
}