October 20, 2026
- Researchers are mapping Coruna-like and DarkSword iOS exploit-kit infrastructure across compromised commerce sites. Unit 42 observed associated pages directing iPhone visitors to reopen content in Safari. A later community tally cited 183 affected websites, with vulnerable PrestaShop instances implicated as one compromise vector and retrohunt evidence extending to July. Those counts represent compromised sites, not confirmed infected phones. Unit 42 and vx-underground · Threat Activity