What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
DarkSword and Coruna are separate iOS exploit kits, and both have been linked to attacks involving cryptocurrency wallets. But the reporting describes different profiles: DarkSword collected wallet data alongside broader surveillance and data theft, while iVerify characterized Coruna as appearing mostly focused on crypto theft. Lookout identified DarkSword command-and-control (C2) servers during its investigation; the available reporting does not verify that they remain live today.
DarkSword and Coruna are different exploit kits
Google Threat Intelligence Group published its Coruna analysis on March 3, 2026, and its DarkSword analysis on March 19, 2026. Google says DarkSword spread among different actors in a way that resembles the earlier Coruna case, and reports that the actor UNC6353 used both. That overlap does not make them the same kit.
As an Amazon Associate I earn from qualifying purchases.
The reported components and iOS ranges also differ. Google described Coruna as five full exploit chains containing 23 exploits, and DarkSword as using six vulnerabilities with three named final-stage malware families: GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER. These are counts of technical components, not victims. Google’s Coruna analysis and Google’s DarkSword analysis provide the technical accounts.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall| What was reported | DarkSword | Coruna |
|---|---|---|
| iOS versions | Google reported iOS 18.4 through 18.7; Lookout and iVerify described observed attacks or supported versions through iOS 18.6.2. | Google reported iOS 13.0 through 17.2.1. |
| Technical structure | Google reported six vulnerabilities and three named final-stage malware families. | Google reported five full exploit chains and 23 exploits. |
| Wallet context | Wallet data collection was reported alongside broader surveillance and data theft. | iVerify characterized the kit’s apparent focus as mostly cryptocurrency theft. |
| Reported campaign context | Google described use by multiple actors and campaigns in Saudi Arabia, Turkey, Malaysia, and Ukraine. | Google described successive use involving a surveillance-vendor customer, suspected espionage activity, and a financially motivated actor. |
The version ranges describe findings in particular reports and campaigns; they are not a guarantee that every device in a range was compromised, or that every deployment supported every listed version. Google reported DarkSword use since at least November 2025. Its Coruna report described the kit as ineffective against the latest iOS at the time of publication.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What the reports say about crypto wallets
Lookout reported that DarkSword rapidly collected sensitive information, including cryptocurrency wallet data. iVerify described DarkSword more broadly as a surveillance and intelligence-gathering operation that also searched for wallets, and contrasted it with Coruna, which it said seemed mostly aimed at crypto theft. These are analysts’ characterizations of reported campaigns. They do not establish that every DarkSword or Coruna deployment stole cryptocurrency, that every victim lost funds, or that wallet theft was DarkSword’s sole purpose.
Neither the exploit counts nor the reported exposure estimates are infection counts. iVerify estimated that up to 270 million devices were still running affected versions when it announced its findings on March 18, 2026; that figure is a potential-exposure estimate, not a count of confirmed infections or victims. The cited reports do not establish an independent named victim count for either kit.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What is known about DarkSword C2 infrastructure
Lookout said its researchers identified DarkSword C2 servers while investigating the activity and analyzed malicious infrastructure. Google documented delivery domains and said it added identified delivery domains to Safe Browsing. These findings show that infrastructure was identified during the investigations; they do not establish that those servers or domains are still operational on October 9, 2026. It would be misleading to call them “live C2” today without a current, reliable verification.
Recommended Free Tools
The infrastructure findings are reported in Lookout’s March 18, 2026 announcement and Google’s March 19, 2026 analysis. This article does not reproduce domain indicators or exploitation instructions.
Rank #3
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How to protect an iPhone or iPad
Install the update available for your device
Open Settings > General > Software Update and install the latest iOS or iPadOS security update offered for that device. Google said all DarkSword vulnerabilities were patched with iOS 26.3, though most had been patched earlier. Lookout’s March 18, 2026 guidance specified iOS 18.7.3 or later, or iOS 26.3 or later. Those are dated recommendations, not a substitute for checking what Apple currently offers for your specific model; update availability can differ by device.
Use Lockdown Mode if updating is not possible
Google recommends Lockdown Mode for enhanced security when an update is unavailable, and also recommends it in its Coruna guidance for devices that cannot be updated. On supported Apple devices, find it under Settings > Privacy & Security > Lockdown Mode. It is an additional protective measure, not a universal replacement for security updates or a guarantee against every component of an exploit chain.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If you may have visited a malicious page
Google’s reporting describes watering-hole campaigns, in which attackers compromise or use a site likely to be visited by a target group to deliver malicious content. If you believe your device may have encountered such a page, treat it as a potential security incident rather than assuming a wallet app or an antivirus scan has resolved it.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →- Use a separate, trusted device to review account security and contact relevant wallet or exchange providers through their official support channels.
- For significant cryptocurrency holdings or suspected compromise, seek reputable incident-response help. Do not enter recovery phrases or private keys into a device you suspect is compromised.
- Install the available system update and follow trusted incident-response advice; a consumer accessory or generic cleanup tool is not established as a fix for an already compromised iPhone.
What the campaign history shows
Google’s March 3, 2026 Coruna report described a progression from use by a surveillance-vendor customer to suspected Russian espionage activity attributed to UNC6353 targeting Ukrainian users, followed by broader campaigns attributed to financially motivated UNC6691. In its March 19 DarkSword report, Google described multiple actors and campaigns in four countries, and said UNC6353 had used both Coruna and DarkSword. The sequence helps explain why the kits are sometimes discussed together, while their distinct technical structures and reported iOS ranges remain important.
Best Value
- 【Powerful 130dB Self Defense Emergency Alarm】This personal alarm emits a 130dB ultra-loud siren that can be heard up to 600 feet away, effectively scaring off attackers and drawing attention from people nearby. Ideal for women, kids, elderly, night runners, and anyone walking alone—an essential safety keychain for daily protection.
- 【USB-C Rechargeable & Long-Lasting Performance】Built-in rechargeable battery supports up to 2 hours of continuous siren use and 1 year of standby time. Charging via USB-C cable (universal & fast), no need for frequent battery replacement. Low-power reminder ensures the alarm is always ready for emergencies.
- 【Portable Keychain Design for Easy Carrying】Lightweight & compact with a sturdy keychain clip, easy to attach to bags, purses, backpacks, belts, or keys. Take it anywhere—commuting, traveling, camping, school, or night walks. Discreet but powerful security on the go.
- 【LED Strobe Light & SOS Emergency Function】Equipped with a bright LED strobe light that works as a flashlight for night use and an SOS emergency signal in danger. One-button control for quick activation: pull the pin to trigger alarm + strobe light, maximize your safety in dark or emergency situations.
- 【4-Pack Value Set & Wide Application】Package includes 4 personal alarms (Aqua/Black/Pink/White) + 4 keychains. Perfect for family, friends, and daily sharing. FCC/CE certified, safe and reliable. If the alarm sounds weak, simply recharge it via USB-C for full power again.
Lookout and iVerify published DarkSword findings on March 18, 2026, emphasizing different aspects of the activity: rapid collection and exfiltration in Lookout’s account, and broader surveillance in iVerify’s characterization. Google’s analysis followed on March 19. These dated accounts support caution about wallet data exposure, but not a claim that all affected devices were infected or that a current C2 server is confirmed live.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
