DarkSword iOS exploit kit: fake captcha gate with a hidden exploit iframe (Coruna wallet stealer)

One hunt for the campaign. YARA anchor: the delivery page's structure (the postMessage redirect handler together with the hidden loader iframe or the captcha stylesheets and config, the Safari escape link with the gated overlay), or the loader document itself. It never keys on a brand, because each site's config names the brand it imitates. Search anchor: the delivery and stage hosts hdios[.]cn, ios.hdios[.]cn, i.131422[.]com, ios.131422[.]com, fc.131422[.]com, rne8b0wt5znenjp[.]xyz and cf.rne8b0wt5znenjp[.]xyz as exact hostnames, plus every subdomain of the operator domains 131422[.]com, tenso[.]cc and hdykw[.]co. On 2026-10-09 four more 131422[.]com subdomains (fdc, k, q and r1) served the kit page from the same server as ios.tenso[.]cc, and ios18.tenso[.]cc, an alias of htadmin.trxduih[.]top, showed a Chinese-language login to an "iOS operations centre", most likely the operator's panel (an assessment); ios.tenso[.]cc is an alias of i.131422[.]com. trxduih[.]top (registered 2026-09-05) is included on that link: its other hosts on the panel's server show a TRON "energy" and wallet-lookup page. Also included: the C2 of builds found in the wild, 66ds[.]lol, and the backup delivery hosts fc.rsqqq[.]top and st.onlinefc[.]top. hdykw[.]co is included on infrastructure overlap: ios.hdykw[.]co shared the delivery server with hdios[.]cn, and n.hdykw[.]co advertises a Windows remote-access tool that steals wallets, browser passwords and Telegram sessions. Read that link as an assessment, not proof. The exploit runs only on iOS, so a desktop capture shows the captcha gate, a QR code or an empty page, never the exploit. The loader's own comments are in Chinese and show active development, with iPad support added on 2026-09-11 and in-app browsers targeted from 2026-09-20.