Apple Sends Lock Screen Alerts to Outdated iPhones Over Active Web-Based Exploits

Apple is issuing Lock Screen notifications to iPhones and iPads running outdated iOS versions to warn users about active web-based exploit kits.

• •Two exploit kits, Coruna (targets iOS 13.0–17.2.1) and DarkSword (targets iOS 18.4–18.7), are being used by multiple threat actors to deliver malicious payloads via compromised websites.
• •Kaspersky identified Coruna as an evolution of the Operation Triangulation framework, a sophisticated zero-click iMessage exploit campaign first disclosed in June 2023.
• •The spread of these kits raises concerns about democratizing nation-state-level exploits, potentially turning them into mass-exploitation tools.
• •Users who cannot update are advised to enable Lockdown Mode (available on iOS 16+); Apple states no Lockdown Mode-enabled device has been successfully attacked by mercenary spyware.