Most people know to be suspicious of an unexpected text claiming to be from their bank. This campaign works because the message comes from someone the victim already knows and trusts.

How the scam works

The message arrives from a contact’s WhatsApp account, which has most likely already been compromised by the same scam. It includes a link and asks the recipient to vote for a child taking part in a contest.

The site asks the victim to pick a contestant, then to enter their phone number and the code they receive.

That code links the victim’s WhatsApp account to a device the attackers control.

The site also offers a QR code to scan, which links the account in the same way.

Once linked, the attackers can read the victim’s new messages and send messages in their name, including the same voting link to everyone in their contacts. The victim’s phone carries on working as normal, so most people have no idea their account has been taken over.

The phishing pages are also built to stay out of sight. Each one loads only when visited through its full URL, and visiting the bare domain returns a 403 Forbidden error, which makes the sites harder for automated scanners to find.

Why this matters for organisations

Many employees use WhatsApp to talk to colleagues, clients, and suppliers, whether on a company phone or their own. A hijacked account gives attackers a view into those conversations and lets them message people as a trusted member of staff. Because the lure arrives through a messaging app, email security tools never see it, and mobile device management doesn’t close the gap either, because MDM and mobile threat defence do different jobs.

Indicators of compromise

We identified the following domains through our own detections and reverse IP lookups. They have been defanged so they can’t be clicked, and most are now offline.

• ballethfibs[.]cc
• czechballetschool[.]site
• awardancing[.]cc
• awardancing[.]ws
• awardancing[.]com
• awardancing[.]sbs
• awardancing[.]cfd
• besttack[.]top
• jordan-skill[.]com
• skill-bright[.]cyou
• sup-steel[.]click
• wiki-drell[.]online

Almost every phishing URL we saw used one of these two paths:

• /p/29/#
• /l/vote2026m11

The domains resolved to two IP addresses, hosted in Czechia and France:

• 95.182.87[.]131
• 138.124.92[.]4

The hosting location shows where the servers are rather than where the attackers are. However, the website’s source code contains extensive comments written in Russian, which suggests it was built by Russian speakers. The code also makes repeated references to Telegram, suggesting the template may have been reused from an earlier scam targeting Telegram users. The site shows signs of being built with AI tools, including AI-generated images. A template that has already been adapted from one messaging app to another could easily be adapted for other countries and languages, so we expect this campaign may spread.

How Corrata detected the campaign

Corrata’s zero-day phishing protection (ZDP) assesses domains it has not seen before and quarantines them if they are judged risky. None of the domains in this campaign had been seen before, so ZDP assessed them, judged them risky, and blocked access, whether the link arrived by WhatsApp, SMS, or any other app. This stopped users before they ever reached the page asking for their phone number, so customers were protected before the scam had a name.

How to keep yourself safe

1. Never enter a code into a website: WhatsApp verification and pairing codes are only ever needed inside the WhatsApp app. If a website asks you to enter your phone number and then a code you’ve just received, close it, because that is how attackers link your account to their device.
2. Check your linked devices: Open WhatsApp settings, go to Linked devices, and review everything listed there. If you see a device you don’t recognise, log it out straight away.
3. Turn on two-step verification: This adds a PIN that’s needed whenever your number is registered on WhatsApp, which makes it much harder for someone to take over your account.
4. Confirm unusual requests with the sender: If a friend sends you a link asking you to vote, donate, or log in, call them or message them on a different app to check they really sent it. Their account may have been compromised.
5. Treat links on every platform with caution: Phishing now arrives through WhatsApp, Telegram, social media, and QR codes as well as SMS and email, often from people you trust.

For organisations

Staff can’t be expected to spot a convincing link from a friend every time, so protection needs to work at the device level through mobile threat defence. Corrata’s zero-day phishing protection blocks links like the ones in this campaign whichever app they arrive through, even when the domain is brand new.

To see how it works, request a demo.

The post The WhatsApp “vote for my friend’s child” scam that takes over your account appeared first on Corrata.

What Citizen Lab found

Citizen Lab found that devices at the international news network Al Jazeera were infected with spyware from Candiru, the Israeli vendor that has since rebranded as Integrity Labs. At least 45 Al Jazeera devices were targeted in attacks during 2024 and 2025. The user did not need to click anything, because simply displaying the ad was enough to start the infection. Citizen Lab calls this technique AdFection, and describes it as the first public technical confirmation of zero-click mercenary spyware delivered through targeted ads.

Candiru has been known to researchers for some time. Citizen Lab first documented its attack chain in 2021, and assessed the sample recovered from Al Jazeera as a newer version of that chain. Confiant published a parallel investigation on the same day.

How the AdFection attack worked

Every time an app or website shows an ad, a real-time auction takes place. The device sends a bid request containing details such as device identifiers, IP address, and location. Advertisers then bid, and the winning ad is delivered, all in under a second. These auctions happen hundreds of billions of times a day on exchanges run by companies including Google and Yandex.

According to Citizen Lab, an Israeli company called Discover-Tech presented itself as a legitimate ad buyer but operated as a facilitator for several mercenary spyware vendors, including Candiru. Its ads carried a script that contacted Discover-Tech’s own server when the ad rendered. That server checked the device’s advertising identifiers and IP address. 

For most devices it returned nothing, while for selected targets it returned code. Network logs from Al Jazeera showed infected devices contacting Discover-Tech’s infrastructure first, then a Candiru validator server that checked the device, and finally a Candiru command and control server.

Controlium: the targeting console behind the ads

Citizen Lab also examined Controlium, a Discover-Tech platform that gives customers a control panel for these malicious “controlled ads”. Customers can choose whom to target by mobile advertising ID on iOS or Android, by browser identifier, or by IP address. Administrators can also restrict which countries each customer is allowed to target. Further modules show recent bid requests and ad impressions for a given identifier, which can be used to monitor a target’s activity.

A separate threat actor, which Citizen Lab calls DARK CARTOGRAPHER, used Discover-Tech’s infrastructure to run ads that tried to reveal the real IP addresses of VPN and proxy users and to unmask the phone numbers of mobile users. Citizen Lab reports that this actor’s infrastructure links to a mercenary adtech vendor and a US government contractor, and says a fuller report will follow.

Why mobile devices are in scope

The implant recovered from Al Jazeera was a Windows file, and the report does not confirm a mobile implant. However, the channel used to deliver and profile targets is overwhelmingly mobile. About three quarters of Discover-Tech’s bids were for ads inside mobile apps. Over four months, ads carrying its attacker script appeared in more than 75,000 Android and iOS apps, including mainstream messaging, email, weather, and gaming apps.

Even when no spyware was delivered, the ads still sent data back to Discover-Tech. In the UK, Citizen Lab recorded ID-syncing requests to Discover-Tech domains during a visit to The Guardian’s website. Its ads also appeared on government, defence, and critical infrastructure networks across Europe.

After Citizen Lab’s disclosure, Google, IAB Europe, Beeswax, and Eskimi cut off Discover-Tech’s access, and Vungle (Liftoff) paused it pending review. The wider lesson for security teams is that every ad request shares data about the device, and ADINT turns that data into a targeting tool.

How Corrata limits ADINT exposure

Over the past year, Corrata has treated ADINT as a real threat, and we have explained how the ad economy harvests location data from employee devices. In a typical week, Corrata blocks between 1,000 and 2,000 different advertising domains in real time across our platform. These range from well-known ad vendors to obscure services that often go unnoticed.

Turning off the mobile advertising ID on a device helps, but other details such as IP address, location, and operating system version can still be shared with ad services. With Corrata, you can block access to these domains completely, so this information is not shared with third parties. Alternatively, you can allow the domains and report on them, giving you visibility of the ad domains that websites and apps use to collect data.

Corrata also scans the apps on employee devices for background location tracking, which it classes as a potentially dangerous permission. It alerts the user and, if the issue is not addressed, can quarantine the device until action is taken.

To find out how exposed your organisation’s mobile devices are to ADINT, request a demo of Corrata and talk to our team.

The post ADINT and AdFection: Spyware Delivered by Ads appeared first on Corrata.

Kirwan brings over 20 years of experience across the network monitoring and cyber security landscape in EMEA and APAC, alongside several years building and scaling enterprise SaaS businesses across EMEA. He stepped into the CEO role in June 2026.

Kirwan takes over a business with an established position in mobile security and a growing presence in the European enterprise market. His appointment reflects Corrata’s focus on its next phase of growth.

“I am proud to lead this team into our next chapter,” said Mark Kirwan, CEO of Corrata. “Corrata has built something genuinely valuable in mobile security, and the opportunity ahead in the enterprise market is significant. My focus is on building on that foundation and bringing Corrata’s protection to more organisations across Europe and beyond.”

Healy, who founded the company and led it through its early growth, will remain involved in an advisory capacity. 

“It has been a privilege to build Corrata and to work with the team we have today,” said Colm Healy, founder of Corrata. “Mark is the right person to lead the company into its next stage. He brings the experience and the discipline to take what we have built and grow it, and I am confident the company is in good hands.”

Kirwan’s appointment is effective immediately.

About Corrata

Corrata is a mobile endpoint security company headquartered in Dublin, Ireland. Its on-device technology delivers comprehensive threat detection and response for iOS and Android devices, combining advanced mobile threat defence with data loss prevention. Corrata is recognised by independent analysts and customers as a leader in Mobile Threat Defence, with customers spanning healthcare, logistics, professional services, manufacturing and the public sector. Corrata is a verified European cybersecurity company, a member of the Microsoft Intelligent Security Association, and is ISO 27001 certified.

The post Corrata Appoints Mark Kirwan as Chief Executive Officer appeared first on Corrata.

Company investing in domain-specific Small Language Model for privacy-compliant mobile threat detection as AI reshapes the attack landscape

DUBLIN and LONDON, 3 June 2026 (Infosec Europe, ExCeL London) ** Updated on 9 June 2026: terminology updated from “on-device LLM” to “domain-specific SLM” to more accurately describe the model in development. — Corrata, the mobile endpoint security company, today announced a comprehensive reimagining of its approach to mobile device security in response to the rapid transformation of the threat landscape by artificial intelligence. The announcement encompasses new AI governance capabilities, enhanced data loss prevention, and a commitment to developing anon-device domain-specific small language model (SLM) for next-generation mobile threat detection.

“The device in your employee’s pocket is simultaneously connected to AI tools, targeted by AI-powered attackers, and operating in an environment where the threat landscape is being rewritten in real time,” said Colm Healy, CEO of Corrata. “The controls deployed two or three years ago were not built for this world. We have rebuilt ours to match it.”

How AI Is Reshaping the Mobile Threat Landscape

Mobile devices sit at the epicentre of three distinct AI-driven risk dimensions that security teams must now contend with simultaneously.

Hyper-personalised social engineering. AI has transformed phishing from a numbers game into targeted precision. Attackers now use large language models to construct lures from publicly available data, producing messages indistinguishable from genuine communications. Research puts the click-through rate on AI-generated phishing at 54%, against 12% for traditional campaigns. On mobile, where 85% of phishing attacks already occur outside email, across SMS, WhatsApp, Teams and other messaging channels, the impact is acute.

AI-accelerated exploits. In May 2026, Google Threat Intelligence Group confirmed a real-world threat actor had used a zero-day exploit developed with AI, planned for mass exploitation and only stopped by proactive counter-discovery. Finding and weaponising vulnerabilities no longer requires deep expertise or months of effort. The median time from disclosure to active exploitation had already fallen from 771 days in 2018 to single-digit hours before frontier AI models entered the picture. Mobile is particularly exposed, where apps are deployed quickly and sometimes outside the review processes that govern traditional software.

Shadow AI and data loss. When employees find that an AI tool makes them more productive, they use it, approved or not. Research suggests 43% of employees share corporate data with LLMs without authorisation. On mobile, where personal and professional boundaries are already blurred, the exposure is acute: sensitive documents uploaded to consumer AI services, client details pasted into chatbots, proprietary code submitted for debugging. Institutional knowledge is leaving organisations at an unprecedented rate, with no visibility and no controls in place.

How Corrata Is Responding

Corrata has always been built on a simple premise: mobile devices deserve the same depth of security monitoring as laptops and servers. Its on-device architecture inspects 100% of network traffic without routing it through a cloud relay, a visibility advantage no competitor has matched. In the AI era, that foundation becomes more important, not less. Corrata has now extended it across three areas.

On-device domain-specific SLM for enhanced threat detection. The vast majority of mobile traffic is now encrypted, and current detection methods will struggle against the more sophisticated social engineering and exploit techniques that AI is enabling. Corrata is developing an on-device domain-specific SLM purpose-built for the mobile environment. A general-purpose LLM cannot run on a phone with the speed, memory footprint and power budget that continuous threat detection requires. By narrowing the model to this single task, Corrata makes it small enough to run on the device itself, in real time, with no data leaving the phone.

AI governance for the mobile workspace. Corrata’s AI Governance capability lets organisations define which AI services and SDKs are sanctioned in the mobile workspace and enforces those policies automatically. Approved tools are unaffected; access to unsanctioned services, including consumer chatbots, AI coding assistants and embedded LLM SDKs in third-party apps, is flagged or blocked. As AI governance frameworks including ISO 42001 and the EU AI Act mature, mobile is the enforcement gap most organisations have yet to close. Corrata closes it.

Precision mobile DLP for the AI age. Data leakage via mobile is no longer confined to lost devices or unencrypted email. AI tools are now a primary exfiltration channel. Corrata’s enhanced data loss prevention uses fine-grained traffic analysis to detect sensitive corporate data being transmitted to external services, whether deliberately or inadvertently, enabling security teams to act on genuine data loss events rather than chase false positives.

“Corrata brings together the deepest visibility into mobile traffic of any solution on the market with a new generation of AI-native capabilities built for the threats that matter most right now,” said Colm Healy.

Availability

Corrata’s AI Governance and enhanced DLP capabilities are available now. The on-device domain-specific SLM is in active development, with availability to be announced.

About Corrata

Corrata is a mobile endpoint security company headquartered in Dublin, Ireland. Its on-device technology delivers comprehensive threat detection and response for iOS and Android devices, combining advanced mobile threat defence with data loss prevention and AI governance. Corrata is a member of the Microsoft Intelligent Security Association (MISA), verified for use with FirstNet, and is accredited as ‘Cybersecurity Made in Europe’ by ECSO. For more information, visit corrata.com.

###

The post Corrata Reimagines Mobile Device Security for the AI Era appeared first on Corrata.

The emergence of two exploit kits, Coruna and DarkSword, marks a turning point. For the first time, we have clear evidence of nation-state-grade iOS exploitation being used to drain cryptocurrency wallets, steal banking credentials, and conduct broad-based financial fraud.

The threat model has fundamentally changed: where previously an ordinary business user had little reason to fear Pegasus-style spyware, today any unpatched iPhone visiting the wrong website is a potential target.

This post traces how we got here – from the first discovery of Pegasus in 2016, through a decade of escalating sophistication, to the moment that sophisticated iOS exploitation went criminal – and explains what your organisation needs to do about it now.

The Beginning: Pegasus and the First Pegasus Attacks (2016)

The story of iOS commercial spyware begins in 2016, when Ahmed Mansour, a UAE human rights activist, received suspicious text messages promising “new secrets” about detainees tortured in UAE jails. Instead of clicking the links, he forwarded them to Citizen Lab.

Researchers used a jailbroken iPhone to visit the URLs and discovered a weaponised exploit chain delivering a sophisticated implant – the first publicly documented case of a commercial company selling advanced iOS malware.

The malware was Pegasus, developed by Israeli firm NSO Group. That first version used a WebKit vulnerability as its entry point and required the target to click a link – what the industry calls a “one-click” attack.

Once on the device it installed an implant called BridgeHead (BH), dropped persistence files to disk, and exfiltrated data. Because NSO made no attempt at cleanup, Citizen Lab and Lookout Security were able to identify the implant process name, the infrastructure URLs, and the persistence mechanism with relative ease.

The public disclosure was a turning point. NSO Group understood they had been caught – and immediately set about making Pegasus harder to detect.

Going Zero-Click: WhatsApp and iMessage (2019–2021)

By 2019 NSO had shifted to zero-click attack surfaces, meaning the target’s phone could be compromised without the victim doing anything at all. A joint investigation by WhatsApp and Citizen Lab revealed that NSO was exploiting a vulnerability in WhatsApp calls – simply receiving a call was enough to trigger infection. Missed calls appeared in the victim’s call log, which became one of the primary forensic indicators for this campaign.

In 2021 the Pegasus Project – a collaboration involving Amnesty International, Citizen Lab, and media partners – analysed a leaked list of roughly 50,000 phone numbers believed to be potential Pegasus targets.

Forensic analysis of around 100 devices found 80 confirmed infections. Targets included President Emmanuel Macron of France, senior politicians in Spain and other countries, journalists, lawyers, and human rights activists across dozens of nations. By this point Pegasus had clearly moved far beyond its original stated purpose of targeting criminals and terrorists.

The technical highlight of this period was the “FORCEDENTRY” exploit, which attacked iMessage’s image rendering pipeline by building a virtual machine inside a PDF parser to achieve code execution and sandbox escape without any user interaction. Google Project Zero published a detailed analysis describing it as one of the most technically sophisticated exploits ever seen in the wild.

Forensically, Pegasus was becoming more careful. Process names were now chosen to mimic legitimate iOS processes, though with subtle one-letter variations that a trained analyst could spot. The implant also began delaying device shutdowns – a behaviour that left traces in a file called shutdown.log – and started attempting to clean up iMessage attachment directories after infection. Crucially, it cleaned only one of two relevant database tables, leaving a distinctive discrepancy that became a reliable detection signal.

The Ecosystem Expands: State Campaigns and New Vendors (2019–2022)

NSO was not operating alone. Several other commercial and state-linked actors emerged during this period.

iSoon / Chinese State Actor (2019). Google’s Threat Analysis Group documented a campaign attributable to the Chinese contractor iSoon (not publicly named at the time) that hosted five different WebKit exploit chains – fourteen vulnerabilities in total – targeting devices from iOS 10 through iOS 14.

Anyone who visited the infected web servers would have been compromised regardless of their identity. The malware transmitted stolen data completely unencrypted over the network, a remarkable operational security failure that allowed researchers to recover everything. This was the first publicly documented case of iOS exploits used in mass, indiscriminate attacks.

LightSpy / TwoSail Junk (2020). In early 2020, Trend Micro and Kaspersky documented a watering hole campaign against iOS users in Hong Kong that used a full remote exploit chain to install a modular implant named LightSpy.

The attackers built web pages mimicking local news sites, including one that copied the HTML of a Hong Kong newspaper, and embedded a hidden iframe that loaded the exploit script. Links were posted to four Hong Kong discussion forums, and anyone visiting with a vulnerable iOS version was compromised.

The chain targeted iOS 12.1 and 12.2, combining a kernel bug tracked as CVE-2019-8605 with a Safari vulnerability that Apple had patched silently without assigning a CVE, according to Trend Micro’s technical brief. Kaspersky discovered the initial watering hole on 10 January 2020, observed mass distribution from 18 February, and tracked the activity under the name TwoSail Junk, which it described at the time as a provisional designation.

The implant was a modular backdoor supporting remote shell execution, file manipulation, and plugin modules that exfiltrated data from applications including WeChat and Telegram. An Android counterpart, dmsSpy, was distributed separately through public Telegram channels.

Predator / Intellexa (2021 onwards). Developed by the Intellexa consortium (previously trading under the name Cytrox), Predator typically used WebKit as its infection vector. Google TAG and Citizen Lab documented campaigns targeting Meta employees, politicians, and journalists.

A Predator infection found in Greece led to a criminal conviction: one of the founders of the Intellexa group was sentenced to eight years in prison for his role in the affair. Forensically, Predator spoofed legitimate iOS process names (such as usereventsagent), stored a configuration file in /private/var/keybagd/, and notably used Apple Shortcuts as a persistence mechanism.

Later versions moved toward network-injection delivery – using a privileged position on the mobile network to inject exploit code into unencrypted (or fraudulently-signed encrypted) web traffic, effectively turning any unencrypted web browsing into a zero-click attack surface.

Hermit (2022). The Hermit spyware, linked to Italian vendor RCS Lab, took a different approach: social engineering combined with a sideloaded application. Operators worked with mobile network carriers to temporarily cut off a target’s internet connection, then sent an SMS inviting the victim to download an app to restore service.

Inside the app, Hermit used a combination of public and privately-held exploits to gain privileged access. Detection is comparatively straightforward – sideloaded apps leave provisioning profiles and appear in device application lists.

Operation Triangulation (2023)

Kaspersky discovered what it called Operation Triangulation, a sophisticated espionage campaign targeting iOS devices – including Kaspersky employees – via zero-click iMessage exploits.

The technical sophistication was a step above anything previously documented: the attack used a three-stage chain, cleaned up iMessage attachment directories, flushed crash logs, and disguised activity under legitimate system process names such as BackupAgent. Attribution pointed toward a nation-state actor with substantially greater operational security discipline than commercial vendors.

A New Generation: Graphite and the Paragon Group (2025)

In early 2025 Citizen Lab published the first evidence of a new commercial spyware vendor – Paragon Solutions – whose tool is known as Graphite. The attack vector identified was WhatsApp. Forensic indicators were deliberately limited; Citizen Lab identified network-level artifacts it named “small pretzel” and “big pretzel” but withheld detailed IOCs to preserve detection capability.

Graphite’s use of raw IP addresses rather than domain names for command-and-control communication was noted as an attempt to evade DNS-level monitoring tools deployed by mobile security vendors.

The Rules Change: Coruna and DarkSword (2025–2026)

Early 2026 has brought a fundamental shift in the iOS threat landscape. Two exploit kits – Coruna and DarkSword – have demonstrated that sophisticated iOS exploitation is no longer the exclusive preserve of nation-states and their approved commercial vendors. The tooling is now proliferating to organised crime.

Coruna

Google Threat Intelligence Group (GTIG) identified Coruna, an iOS exploit kit whose developers named it internally, in early 2025. The kit is extraordinary in scope: five complete exploit chains, 23 individual exploits, and coverage of every iPhone model running iOS 13.0 through iOS 17.2.1. The exploit code is extensively documented in native English with docstrings and comments, suggesting significant professional engineering investment.

Coruna’s history illustrates exactly how dangerous exploit proliferation has become. GTIG tracked it through three distinct phases:

• A commercial surveillance vendor used parts of the Coruna framework in targeted operations in early 2025.
• UNC6353, a suspected Russian espionage group, embedded the same JavaScript framework on compromised Ukrainian websites in summer 2025 as a watering hole attack, delivering exploits to any iPhone user visiting those pages.
• UNC6691, a financially motivated Chinese threat actor, deployed the complete Coruna kit across hundreds of fake cryptocurrency exchange websites, using it to steal credentials and drain crypto wallets.

The payload recovered from the Chinese campaign – GTIG tracks it as PLASMAGRID – injected itself into powerd (a root-level system daemon) and loaded modular plugins targeting 18 different cryptocurrency wallet applications, scanning memos and images for BIP39 seed phrases and banking credentials.

Technically, Coruna is impressively engineered: exploit payloads are encrypted with ChaCha20, served from URL paths derived by hashing a unique cookie, and packaged in a custom binary format. The kit checks for Lockdown Mode and bails out if it detects it. It also incorporates mitigation bypasses – including some exploitation techniques not previously seen in public research – and reuses modules from Operation Triangulation.

Coruna only works against iOS 17.2.1 and earlier. It is not effective against current iOS versions. Any device still running iOS 17.2.1 or earlier should be updated immediately.

DarkSword

Published by Google in March 2026, DarkSword is a separate full-chain exploit kit targeting iOS 18.4 through 18.7. Where Coruna is a compiled, multi-architecture framework, DarkSword is implemented entirely in JavaScript – making it trivially easy to adapt, host, and reuse.

GTIG observed DarkSword used by at least three distinct actors within months of its first appearance:

• UNC6748 targeted Saudi Arabian users via a Snapchat-themed phishing site (snapshare[.]chat), delivering a backdoor called GHOSTKNIFE capable of exfiltrating messages, location history, browser data, signed-in accounts, and audio recordings.
• PARS Defense, a Turkish commercial surveillance vendor, used DarkSword against targets in Turkey and Malaysia, deploying a different backdoor, GHOSTSABER, which supports arbitrary SQL queries against device databases, file exfiltration, and remote JavaScript execution.
• UNC6353 – the same suspected Russian group that used Coruna against Ukrainian targets – incorporated DarkSword into fresh watering hole campaigns on compromised Ukrainian websites, deploying a dataminer called GHOSTBLADE that harvests iMessage conversations, WhatsApp and Telegram data, photos, location history, Safari data, cryptocurrency wallet information, and device keychains.

DarkSword uses six vulnerabilities across its chain, including CVE-2025-31277 and CVE-2025-43529 (both JavaScriptCore memory corruption bugs), CVE-2026-20700 (a PAC bypass in dyld exploited as a zero-day), and additional sandbox escape and privilege escalation bugs. All six have now been patched – most in iOS 18.7.2/18.7.3, with the PAC bypass patched in iOS 26.3.

Any device running iOS 18.7.1 or earlier, or iOS 26.0 through 26.2, is potentially vulnerable to DarkSword variants and should be updated without delay.

How the Threat Landscape Has Evolved

The shift in 2025 and 2026 is the democratisation of high-quality iOS exploits. Both Coruna and DarkSword were used by multiple independent actors within months of their first appearance in the wild, and DarkSword exploit code has since been published to GitHub. For ordinary business users this is a different risk profile from the targeted spyware threat of previous years, because the economics no longer require anyone to consider a given device worth a seven-figure operation.

The delivery model itself, though, is not new. The 2019 campaign documented by Google’s Threat Analysis Group and the 2020 LightSpy campaign both compromised anyone who visited the wrong page. What is new is that the same model is now funded by financial crime as well as by intelligence collection, and that the tooling behind it changes hands between unrelated operators.

Proliferation also runs in the other direction. In August 2026, Arctic Wolf reported that LightSpy, previously linked to Chinese state-backed operations, is now run as a commercial platform with its own branding, billing, and customer demonstrations, and that it has been found infecting routers, which gives operators visibility into every device on the same network.

What Apple Is – and Isn’t – Doing

Apple has shipped a significant number of security mitigations over this decade, including Pointer Authentication Codes (PAC), the Page Protection Layer (PPL), the Secure Page Table Monitor (SPTM), and most recently memory integrity enforcement on iPhone 17. Lockdown Mode, introduced in 2022, does reduce the attack surface – it would have mitigated parts of both Coruna and DarkSword – but at a significant usability cost that makes it impractical for most users.

Apple also issues threat notifications when it has evidence a device may have been targeted. However, these notifications rely primarily on iMessage metadata and Apple service monitoring rather than on-device detection; they provide little actionable forensic detail about the nature or timeline of an infection.

What Apple does not ship is any on-device detection framework analogous to the Endpoint Security framework available on macOS. There is no mechanism for security tools to monitor process creation, file system access in sensitive directories, or crash log patterns in real time. Given that monitoring the /tmp directory and crash logs would have surfaced indicators for every major commercial spyware family documented over the past decade, this remains a significant gap.

In the absence of on-device visibility, network traffic monitoring is the only reliable method for remotely detecting an active spyware infection. Every implant documented in this post – from Pegasus to GHOSTBLADE – must communicate with a command-and-control server to exfiltrate data and receive instructions.

That traffic, however well encrypted, has to traverse the network, and at that point it becomes detectable. Anomalous connections to raw IP addresses, unexpected domains, unusual data volumes from system processes, or traffic patterns inconsistent with normal application behaviour are all signals that network-layer monitoring can surface.

On-device forensic analysis remains the gold standard for confirming and investigating a suspected infection, but for continuous, scalable detection across a fleet of corporate devices, the network is where the evidence reliably appears.

What Organisations Should Do

Immediately:

• Update every iPhone and iPad in your environment to the latest iOS or iPadOS release available for that device. As of August 2026 the current release is iOS 26.6. Do not treat a specific version number as a permanent floor: Apple has been patching this chain across successive releases, and guidance from a few months ago is already out of date.
• Identify devices that cannot run iOS 26 and check them separately. Apple has backported fixes to older branches, including iOS 15 and 16, so an update is available even where a major version upgrade is not. These devices are the largest population still exposed and the one most likely to be missed by a policy written around the current major version.
• List any device that can no longer receive updates at all and remove it from corporate use.

Within three months:

• Implement network traffic monitoring for mobile devices. Network-layer anomalies are detectable even when on-device access is limited, and for payloads that clean up after themselves they may be the only evidence available.
• Review your mobile endpoint security strategy. If your mobile device management platform is your only security control, you have blind spots. MDM gives you an application list; it gives you nothing about exploitation activity.
• Confirm that OS version compliance is monitored continuously rather than audited periodically. The interval between a disclosure and a working public exploit is now measured in weeks.

Within six months:

• Deploy a mobile threat defence (MTD) tool that continuously monitors network traffic for anomalous command-and-control behaviour, rather than one that relies on application reputation checks alone.
• Establish an incident response procedure for suspected iOS compromise, including clear guidance on evidence preservation and access to forensic expertise. On-device forensic analysis is the route to confirming an infection, and it is worth knowing in advance who will perform it.

Corrata provides mobile threat defence for iOS and Android, including network-level detection of spyware communication and vulnerability management to ensure devices are running patched OS versions. Learn more about Corrata’s spyware detection capabilities.

The post From Pegasus to DarkSword – The alarming history of iOS Spyware appeared first on Corrata.

Corrata, a leading provider of enterprise mobile threat detection and response solutions, today announced its recognition as both a Leader and Fast Mover in the GigaOm Radar for Mobile Threat Defense report.

GigaOm praised Corrata’s comprehensive response capabilities, particularly its ability to instantly restrict compromised devices from accessing enterprise resources, as well as its detailed forensic insights. The report also noted Corrata’s high scores across both core and emerging features, stating:

“Corrata is well-positioned for both SMB and large enterprise deployments, thanks to its scalable architecture that processes security functions directly on devices: without routing traffic through proprietary infrastructure.”

In GigaOM’s rating of twenty MTD solutions Corrata’s achieved the highest overall score confirming its position as a market leader.

With the acceleration of digital transformation and the shift to cloud-based services, mobile devices now serve as primary access points for sensitive enterprise data, often lacking the robust controls found on traditional endpoints. Corrata fills this critical security gap with an enterprise-grade solution that defends against advanced spyware, communication interception, and social engineering attacks: including threats delivered via SMS, WhatsApp, Microsoft Teams, and other messaging platforms.

The GigaOm report underscores the growing importance of mobile threat defense (MTD), stating:

“MTD represents a critical cybersecurity capability in today’s increasingly mobile-first business environment. This technology offers comprehensive protection for mobile devices against sophisticated threats including malware, phishing, network-based attacks, and malicious apps. As organizations expand mobile workflows, MTD has become an essential component of enterprise security architecture.”

Colm Healy, Co-founder and CEO at Corrata, commented:

“This recognition reflects our deep commitment to delivering best-in-class threat detection and response for mobile environments. Today, over 50% of devices accessing enterprise systems are phones and tablets: yet many organizations have virtually no visibility into the threats targeting them. Our research shows up to 22% of threats go undetected by traditional solutions. Corrata closes this visibility gap and significantly reduces mobile’s appeal as an attack vector.”

To be included in the GigaOm Radar, vendors were evaluated based on their product capabilities, strategic roadmap, and market presence.Learn more about Corrata’s mobile threat defense solution here.

SOURCE Corrata Ltd

The post Corrata: Leader & Fast Mover in GigaOm MTD Radar appeared first on Corrata.

DUBLIN, May 21, 2025 — Corrata, the leading mobile endpoint threat detection and response provider, published the Living With ECH Report. The first-of-its-kind report examines the impact of the Encrypted Client Hello (ECH), a new privacy protocol that information security professionals fear could make widely-used security tools blind to large swaths of internet traffic.

ECH is an extension to TLS 1.3, the most recent version of the Transport Layer Security standard used to secure the vast majority of internet communications. ECH proposes to enhance privacy by encrypting key information between devices and Content Delivery Networks (CDNs), preventing network providers from identifying the names of websites that individuals are looking to access.

Information security professionals have raised concerns that its implementation may compromise the ability of enterprises to detect and counter cyber threats.

The inaugural report analyzed first-party platform data, billions of connections to web servers made by enterprise employee mobile devices, between January and March 2025. According to the research, more than 9% of the top 1 million domains are ECH-enabled, but less than .01% of TLS connections used the protocol.

However, even though ECH is rarely relied upon in practice, malicious actors are taking advantage of the anonymity the protocol provides: 17% of the total ECH-enabled sites are risky. Chrome users with encrypted DNS enabled are most at risk.

Findings from the Living With ECH Report include:

ECH could degrade, not improve, privacy: Banks and other regulated entities are often required to monitor the internet traffic going into and out of their organization. To date, these enterprises have been able to selectively decrypt traffic without looking at sensitive data like employees’ health records.

But with ECH blocking their filtering, enterprises would have little choice but to decrypt all internet traffic for inspection, drastically degrading employees’ privacy.

Cloudflare is driving ECH adoption: Cloudflare remains the sole tier-one CDN supporting ECH. Almost all of the sites that are ECH-enabled use Cloudflare infrastructure. Major website owners also seem to be wary of adopting the protocol, concerned that users might be blocked from accessing their services by enterprise security infrastructure or by public authorities.

While ECH reduces the visibility of internet service providers (ISPs) and enterprise security teams, CDNs like Cloudfare can still access data under the protocol.

Malicious actors are taking advantage of Cloudflare: Over 90% of phishing detections use Cloudflare infrastructure, according to Corrata’s analysis. In addition to the anonymity provided by ECH, these sites take advantage of other Cloudflare features.

For example, the “captcha” page can be used to direct desktop traffic to the legitimate site while mobile traffic is sent to the fake one. Alternatively, traffic not coming from the targeted country may be redirected to the legitimate site. These are deliberate tactics to avoid detection by security providers.

Barriers to widespread adoption are high: Widespread adoption of ECH would severely curtail the ability of enterprises to identify and block connections to malicious domains, but industry heavyweights who play different roles and have varied motivations must all support ECH before its use can become widespread.

While 20% of devices are configured to use encrypted DNS and DNS resolvers which support ECH, the lack of support from browsers such as Safari and operating systems such as Android make such choices moot.

“The extremely low level of ECH adoption suggests that the security community’s fears that enterprise internet traffic would go dark are not yet being realized,” said Matthieu Bentot, CTO of Corrata. “While the potential certainly exists for ECH to become a thorn in the side of defenders, the early signs are that this is the time to prepare rather than panic.”

The Living With ECH Report is available today.

Research Methodology
Corrata analyzed billions of connections made by devices running Corrata’s threat detection and response solution.

Corrata’s software is used to protect iOS and Android devices and is representative of that important segment of enterprise internet traffic. Corrata has visibility of DNS query and TLS connection metadata for all of these connections and tracked the number of successful ECH connections created between January and March 2025.

About Corrata
Corrata provides endpoint threat detection and response for mobile. Our pioneering architecture delivers real-time visibility into threats targeting both iOS and Android devices, without compromising performance or privacy. Corrata software detects and disables malware, blocks phishing attacks and ensures compromised devices cannot access sensitive data.

Corrata has customers across multiple verticals including healthcare, logistics, manufacturing and the public sector and is verified for use with FirstNet, the US Government network for first responders.

With deployment in less than 24 hours and seamless integration into your existing security infrastructure, Corrata ensures your mobile environment is no longer your weakest link. Corrata is a proud member of the Microsoft Intelligent Security Association and Cyber Ireland. Visit corrata.com.

###

The post Corrata Report Examines Impact of New Privacy Protocol appeared first on Corrata.

If, like the founding team at Corrata, you’ve been working in the mobile space since the dawn of the smartphone age, you’ll fully appreciate that the most critical messaging channel on a mobile phone is not the email inbox but the messaging client. You’ll also understand that the messaging client has only whatever protection your carrier, Google, Apple, or Samsung choose to provide. And as a mobile security professional you’ll question whether relying on consumer-grade protections is an acceptable strategy when it comes to your organization’s data.

To answer this question it’s important to understand the evolving mobile messaging landscape. Many of you will have heard the announcement from Apple that they plan on enabling interoperability between iMessage and the RCS messaging standard increasingly found on Android devices. The RCS (Rich Communication Services) standard has supplanted SMS and MMS on many more recent Android devices. RCS, while offering a messaging experience more akin to WhatsApp than traditional mobile messaging, has not been without its issues. In 2022 RCS services were halted in India due to a deluge of spam. RCS spam has also recently spiked in the US. In the light of these changes it’s worth reviewing not just the evolution of mobile messaging but also how these changes are impacting it as a threat vector.

In the beginning

In the beginning there was only SMS.  SMS is not an IP based messaging protocol. Instead it uses spare resources on the SS7 layer of the telecommunications network. The Short Messaging Service, to give it its full name, debuted in the early 1990s. Nokia’s implementation of the messaging client was particularly successful and contributed to explosive growth both for Nokia and for SMS. By the early 2000s people were sending billions of messages every year. Each New Year’s eve would bring new records in the number of greetings sent by text, threatening to tear down entire mobile networks in the process.

Initially SMS messaging was device to device. This limited its vulnerability to fraud: there was a physical limit on the number of messages which a mobile device could send. What’s more, per message charging meant that the economics of email spam didn’t apply to SMS. This gradually changed with the growth of application to person messaging (also known as wholesale or bulk messaging). A2P messaging was driven by ringtone distribution and voting on reality TV shows such as Big Brother and American Idol. Wholesale messaging was quickly recognised as a money spinner by mobile carriers who opened up their infrastructure to capture the new revenue streams. The decentralized nature of the mobile telecoms system (there are over 750 mobile carriers worldwide) has made it impossible to block spam and other malicious content. The reality is that there will never be an end to SMS based fraud at the network level.

Enter iMessage and RCS

There is nonetheless reason for hope as new IP based messaging systems developed or delivered by Google and Apple start to grab market share. iPhone users will be familiar with iMessage. Today iMessage only works between two Apple users. Apple users can also use iMessage to communicate with a business (Apple Messages for Business) but such communication must be initiated by the end users.

A newer Kid On The Block is Android’s RCS based messaging system. RCS is an operator developed standard which was designed as an evolution of SMS/MMS. It incorporates richer messaging features such as sending files, engaging in chats and responding with emojis. In other words, all of the features that we know and love from popular messaging applications such as WhatsApp.

Initially, RCS was completely unsuccessful due to a failure by carriers to launch the service. Now Google has taken the lead and has developed a successful RCS ecosystem. Using the Google messaging app, or in some cases the built in messaging app, you can send RCS messages to other Android users. Apple’s recent decision to support interoperability between iMessage and RCS is a game changer though it is unlikely that SMS will ever completely disappear (neither Google nor Apple have any plans to stop supporting it).

Anti-spam/Anti-phishing

Security around the RCS/iMessage environment has a number of important elements. Earlier this year Google introduced end to end encryption for RCS messages sent between two Google messaging clients. Google also verifies senders and filters A2P messages sent via its wholesale RCS Business Messaging (RMB) service. These messages, are not end to end encrypted, allowing Google to examine content for signs of fraud or other mis-use. What’s more in contrast with SMS, with RCS there’s effectively a single gatekeeper on wholesale messaging. Messages for Business is Apple’s equivalent to RMB. Critically, from an anti-spam/anti-phishing perspective, Messages for Business only works where an end user initiates an interaction by, for example, directing a question to an online support chat service.

The other important element is the spam filtering performed by the messaging client. This attempts to filter out spam messages which arrive on the device. Google’s messaging client appears to be very effective in this area. iMessage on the other hand has much weaker capability. And the messaging clients provided by phone manufacturers (which are often the default option on Android) provide only very patchy filtering.

Looking to the future

This of course begs the question as to how malicious messages are still ending up on devices notwithstanding Google inspection of wholesale messages. We believe that cyber criminals are bypassing this control by sending messages directly from devices (or more likely dozens of phones racked). End to end encryption makes centralized scrutiny of these messages impossible. What’s more, because the messages are IP based they cost nothing to send and can be sent in large numbers even without a wholesale connection to the service. For these reasons alone we have to expect that message based fraud will remain a viable option for determined attackers targeting high value opportunities. The publication of pypush, an open source proof of concept library that enables any type of computer to send and receive end-to-end encrypted messages over the iMessage protocol, demonstrates that it will also remain relatively easy to push malicious content into the iMessage environment notwithstanding Apple’s efforts.

The widespread adoption of RCS and its interoperability with iMessage will, we believe, significantly reduce consumer focused messaging fraud. In particular, improved spam filters on messaging clients will reduce the incidence of messaging scams reaching the end user. Ironically this will make the messaging channel an even more attractive option for the kind of targeted phishing attack which we see being launched against high value targets. Ultimately we face a future where messaging spam becomes less prevalent but targeted phishing attacks over the mobile channel remain a serious concern.

The post The most dangerous app on your phone appeared first on Corrata.

The Internet of Things (IoT) has been a game-changer in personal and professional realms. With simple, cost-effective devices, we’re now able to secure our homes, remotely manage climate control, and grant access to facilities: all at our fingertips.

And it’s not just in our homes. The availability of low-cost, wide-area network-enabled sensors and other devices has allowed a degree of optimization and automation that was previously unthinkable except in the most tightly controlled industrial settings. IoT is improving both the performance and efficiency of whole industries, including areas such as agriculture, health care, and logistics. Additionally, it is bringing the era of truly smart cities a step closer.

Shadow IT on steroids?

Yet, as we harness IoT to optimize operations, we face the many of the same challenges we faced with ‘Shadow IT’: the use of IT systems within organizations without approval. This comparison is apt due to several overlapping concerns:

• Lack of oversight: IoT devices are often added to enterprise environments with minimal scrutiny on their cybersecurity implications.
• Cybersecurity neglected: Security measures may be sidelined or overlooked, viewed more as hurdles than necessities.
• Device management is inconsistent: The upkeep of these devices is frequently inconsistent, with many left unsupported or unmonitored.

IoT devices also present challenges unique to their nature:

• Opaque network behavior: Their operations can be difficult to monitor or understand.
• Underestimation of value: They might not be viewed as critical business assets, leading to neglect.
• Background operation: Many devices operate silently in the background, making them easy to overlook.

Generally, anything that lurks in the shadows will present unseen risks.  IoT devices are no different.

The Concealed Dangers of IoT

The growth of IoT introduces compliance challenges as devices handle data interactions with the physical world, which may be secondary to their core function. The implications for data management and potential vulnerability to tampering are significant, with security often taking a backseat to functionality.

While IoT devices are marketed for their ease of use, this convenience can be a double-edged sword. Simplified setups can inadvertently make it easier for attackers to exploit vulnerabilities. It is hard to make software easy and convenient for legitimate uses without also making it easy and convenient for an attacker to achieve illegitimate ones.

And so we regularly come across apps controlling IoT devices over unencrypted connections using hardcoded default credentials.

For instance, consider this security camera setup:

GET /web/ HTTP/1.1

Host: 192.168.1.200

User-Agent: Mozilla/5.0 (X11; Linux ×86_64; rv:60.0) Gecko/20100101 Firefox/60.0

… [rest of the headers] …

Authorization: Basic YWRtaW46YWRtaW4=

Connection: close

Turns out that the “Authorization” code above is simply admin:admin in Base64.

This directly leads to the usual issues: an attacker could add the device to a BotNet, take control of it and abuse its hardware components, or access or compromise its data. An attacker could also use the device as a stepping stone into other internal systems or devices. What’s more, having such hard-coded credentials makes it difficult to patch security vulnerabilities without breaking the device.  As a result many IoT devices are poorly maintained. 

A real-world concern arises when enterprises lose sight of their IoT devices. Without regular maintenance, these devices can become sleeping security timebombs. We’ve encountered organizations with numerous IoT devices running unchecked due to uncertainty about their function and location: posing serious cybersecurity risks.

As we integrate more IoT devices into our daily lives and workspaces, it’s crucial to be proactive in understanding and mitigating the risks they pose. A holistic approach to IoT security can help ensure that we reap the benefits without compromising safety.

Embracing IoT with Awareness

IoT technology is forging our future, introducing interconnectedness that must be managed with caution. These devices should be treated with the same security rigor as computers, with dedicated policies for consistent updates and monitoring.

As IoT’s ecosystem flourishes, keeping abreast of technological vulnerabilities is as crucial as celebrating innovation. A commitment to continuous education and vigilance will enable organizations to benefit from IoT without sacrificing security.

In conclusion, integrating IoT into enterprise systems demands a balanced approach: valuing innovation while upholding strong security standards to avoid the pitfalls that accompany these advanced technologies.

The post IoT – Shadowy Things ? appeared first on Corrata.

Last year, Meta disclosed that the hacker group Bitter APT had embedded their Dracarys malware into fake versions of Signal, Telegram and Whatsapp. Corrata has also encountered similar malware in the wild. And more recently, researchers at ESET discovered trojanized versions of Signal and Telegram on Google Play and in the Samsung Galaxy Store. 

What’s Happened?

These malicious apps, named ‘Signal Plus Messenger’ and ‘FlyGram’, were embedded with the BadBazaar spyware and were uploaded by a Chinese APT hacking group known as GREF. Initially, this malware targeted ethnic minorities in China, but recent data indicates that users in countries including Ukraine, Poland, the Netherlands, Spain, Portugal, Germany, Hong Kong, and the US are now being targeted.

The spyware’s capabilities are extensive, ranging from tracking device locations, stealing call logs, SMS, recording phone calls, to exfiltrating contact lists and files. The malicious versions of these apps have novel features that allow attackers to link victims’ Signal accounts to their own devices, enabling them to monitor all future messages. Both malicious apps (FlyGram and Signal Plus Messenger) have been removed from Google Play and Samsung Galaxy Store but are still available from 3rd party sites. 

The Hidden Threat: Trojanized Messaging Apps on the Rise

As you can see above, hackers are successfully deceiving users into downloading counterfeit versions of popular messaging apps. These imposter apps have been ‘trojanized’, meaning they contain concealed malware within what appears to be a safe application. At first glance, these apps might seem appealing due to additional features not present in the standard versions. However, the hidden malware can pilfer a broad spectrum of data, including the messages themselves.

This type of attack is possible because of a key aspect of internet applications: the application developer may control the back-end but ultimately cannot fully control the front-end application.  This is true whether the user is accessing the application via a browser or a mobile app.  

The end-user has control over the software running locally (i.e. the mobile app or the browser). This is fine if the app is the legitimate version, but if the user has downloaded a fake version, the owner of the legitimate service (e.g. WhatsApp) has no way of knowing this. 

Why is this Alarming?

Given the sensitive nature of information shared over these messaging platforms, the risks associated with using a malicious version are immense. This concern is magnified when you consider that employees often use these apps for work-related communication.

Attackers typically take the source code of legitimate apps like Signal and layer on additional features that serve dual purposes:

1. Attracting users with enhanced features.
2. Granting malicious capabilities to the hacker.

With this malicious layer, attackers can:

• Link other devices, maintaining persistent access even after the malicious app’s removal.
• Leak data from the account.
• Perform on-device malicious actions, such as accessing files, location, and messages.
• Often grant extensive permissions to legitimate apps. For instance, WhatsApp requires access to photos, videos, in-chat media, and user location. Malware often manipulates users into granting these permissions, especially when the app appears legitimate.

The Bigger Picture

While these attacks are often targeted at consumer applications such as the ones named above, there’s no barrier preventing business tools like Slack, Teams, or Outlook from being trojanized similarly. Signing into these compromised apps could grant attackers access to company data, credentials, and authentication tokens – see here. The “Adversary” in this case is not traffic-level eavesdropping but on-device eavesdropping.

Mobile users are advised to always take care to download only the official versions of apps and to steer clear of third-party versions that claim to offer enhanced features, even if they are available on official app stores.

How to protect your organization

Robust defense against such threats consists of three elements:

• Firstly, make sure that your mobiles are prevented from accessing websites which host malware. 
• Secondly, ensure that your employees’ devices are continuously scanned for potentially harmful applications and 
• Thirdly, monitor traffic to and from employee devices to detect communications with Command and Control (C2) servers and other suspicious traffic.

The simplest way to provide these protections is to deploy a mobile threat defense solution to your employee devices. The right solution will provide the necessary protection while being easy to deploy and manage and avoiding the need to collect employee personal information. 

The post Deceptive Downloads: The Silent Menace of Trojanized Messaging Apps appeared first on Corrata.