{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/web-traffic/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["iOS"],"_cs_severities":["high"],"_cs_tags":["exploit-kit","ios","web-traffic"],"_cs_type":"advisory","_cs_vendors":["Apple"],"content_html":"\u003cp\u003eAnalysis of network traffic captured on 2026-10-16 identifies activity consistent with a Coruna-like exploit kit targeting iOS devices. The activity involves web-based delivery, leveraging HTML files and specific redirection patterns observed in packet captures. This activity is associated with recent reports regarding Coruna and DarkSword exploit kits.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eObserved traffic indicates potential unauthorized delivery of exploit payloads to iOS devices. While specific CVEs were not disclosed in this traffic analysis, the activity poses a risk of remote code execution or unauthorized device access.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory iOS devices within the environment and ensure they are updated to the latest security baseline provided by Apple.\u003c/li\u003e\n\u003cli\u003eReview network egress logs for traffic patterns associated with known exploit kit redirectors.\u003c/li\u003e\n\u003cli\u003eMonitor for anomalous HTTP or HTTPS requests originating from iOS devices to untrusted or newly registered domains.\u003c/li\u003e\n\u003cli\u003eAnalyze the provided PCAP and HTML artifacts from the source report in an isolated sandbox to identify environment-specific indicators of compromise.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-23T06:43:42Z","date_published":"2026-10-23T06:43:42Z","id":"https://feed.craftedsignal.io/briefs/2026-10-coruna-like-ios-exploit/","summary":"Observed network traffic patterns indicative of a Coruna-like exploit kit targeting iOS devices via web-based delivery mechanisms.","title":"Coruna-like iOS exploit kit activity","url":"https://feed.craftedsignal.io/briefs/2026-10-coruna-like-ios-exploit/"}],"language":"en","title":"CraftedSignal Threat Feed - Web-Traffic","version":"https://jsonfeed.org/version/1.1"}