DarkSword router's iOS 26 route, C10, is switched off

Key takeaways

• An iPhone exploit server at 154.222.16[.]220 routes visitors by iOS version. iOS 13 to 17 gets Coruna, iOS 18 gets DarkSword, and anything newer goes to a route called C10.
• C10 is controlled by one JSON file, /profiles/c10_deploy.json. On 5 November 2026 it read "enabled": false, and the server had no files at the C10 path.
• The server lists one exploit plugin for iOS 26, filed as CVE-2026-10001. That CVE is a Google Chrome bug, and the plugin's gadget addresses are 0xFFFFFFF007123456 and 0xFFFFFFF007234568.
• Visitors land on a fake Cloudflare check branded for OKX. When DarkSword fails on a phone, the loader falls back to Coruna, and both kits report to the same server.

Acknowledgements: Aidan Holland of Censys documented the gooll chain on hdios[.]cn and an unfinished iOS 26 chain in the DarkSword/Coruna Open Directory Finding Report on 7 October 2026.

This server has a route for iOS 26, and the route is switched off. We captured its landing page on 4 November 2026. On 5 November we requested its config, router and chain files by path.

Background

Coruna and DarkSword are iPhone exploit kits disclosed in March 2026. Coruna covers iOS 13 to 17.2.1. DarkSword, described by Google, iVerify and Lookout, covers iOS 18.4 to 18.7.

DarkSword's code leaked days after disclosure. Other operators have served it since.

Apple named the release after iOS 18 "iOS 26". There was no iOS 19 to 25, so a route for "iOS 19 and later" is a route for iOS 26.

In October, Censys found an operator's working files in an open directory. They included a gooll/ chain on hdios[.]cn and an iOS 26 chain whose later stages were one-byte placeholders. The server in this article has the same client/, profiles/ and gooll/ folders.

Infrastructure

The IP was reported publicly as a ClickFix host at 15:30:13 UTC on 4 November 2026. We captured it 35 minutes later. It shows a fake Cloudflare check, which explains the ClickFix label, but the page copies no command. It loads an iOS router.

Time (UTC)	Event
2026-10-07	Censys publishes its report on the operator's open directory [Censys]
2026-10-31 15:36:12	Last update to the server's iOS 18.7 allowlist, per its updated_at field
2026-11-04 15:30:13	154.222.16[.]220 reported publicly as a ClickFix host
2026-11-04 16:05:33	Our capture of the landing page and the router
2026-11-05	/profiles/c10_deploy.json reads "enabled": false; lab page and plugin list read

The server answers any path it does not have with its landing page. That page is 18,187 bytes, SHA-256 24bf40a618f164223b7e8d32b3f7fc4f9110b4c304189306790d39355f0901f3. The server returns it for /favicon.ico, /C10/ and /C10/b.html.

Technical analysis

Stage 1: A fake Cloudflare check branded for OKX

The landing page copies Cloudflare's "Security verification in progress" screen, down to a Ray ID. Its settings file, /src/recaptcha.config.js, sets siteDomain to OKX and redirectUrl to https://web3.okx.com/.

The page wants an iPhone in Safari. A desktop visitor gets a QR code to scan with a phone. A phone in another browser is told to open the page in Safari.

When a chain reports back, the page switches to "Verification complete". It tells the visitor to keep Safari open with the screen on for about two minutes. The script holds back the OKX redirect so the visitor stays on the page.

Stage 2: The router picks a chain by iOS version

The landing page loads /client/chain/ios_chain_routing.js and /client/lp-router.js. A comment at the top of the routing module says the operator's panel, API and landing page all share it.

The router reads the iOS version from the browser. It fetches two JSON files from /profiles/. Then it opens the chosen chain in a hidden frame, 1 pixel wide at 0.01 opacity.

The landing page turns on an automatic lab mode. That sends iOS 18.6.3 and later to the lab page with no lab flag in the link. For iOS 18.7, the router moves the whole tab there. A comment in lp-router.js says Safari throttles the hidden frame and the stages never start.

The server also keeps an iOS 18.7 allowlist, /profiles/ios_187_gray_gate.json. It holds one device: build 22H311, iOS 18.7.5, with a serial number.

The lab page starts the DarkSword stages with rce_loader.js. If the first stage fails, the loader logs a fallback to Coruna. The same page carries a token for posting Coruna results, so both kits report to one panel.

Stage 3: The C10 route is a switch in a JSON file

Every visitor on iOS 19 or later goes through this function:

function c10DeployActive(c10Deploy, ios, ctx) {
  if (!ios || typeof ios.major !== 'number') return false;
  const lab = !!(ctx && ctx.lab);
  const force = !!(ctx && ctx.forceC10);
  const min = c10Deploy ? Number(c10Deploy.min_ios_major) || 19 : 19;
  if (ios.major < min) return false;
  if (c10Deploy && c10Deploy.enabled) {
    if (c10Deploy.lab_requires_flag && !lab) return false;
    return true;
  }
  return lab && force;
}

C10 opens in two cases: the config sets enabled, or the link carries the test flags ?lab=1&c10=1. On 5 November the config read "enabled": false, "min_ios_major": 19 and "c10_path": "/C10/b.html".

The config's notes are in Chinese. They say that once enabled, iOS 19 and later goes to /C10/b.html, apart from the iOS 18.7 DarkSword line. The C10 secret is kept on the server.

With C10 off, the router logs a status for the panel: "not supported (C10 not mounted in production)". A banner script holds the text for the same case: "iOS 19+ is outside the 13 to 18.7 coverage promise; while C10 is off, visit only."

The C10 path has nothing behind it. /C10/b.html returns the landing page. Its scripts load from under /C10/, and every one returns 404, as does /C10/root.js, the file the config notes name.

The iOS 26 plugin carries a Chrome CVE

The DarkSword lab page loads /api/plugins/list. It lists four exploit plugins, each with an iOS range, a priority and a reliability score:

Plugin ID	iOS range in the list	What the CVE record says
CVE-2025-24243	17.0 to 18.4.1	Apple, fixed in iOS 18.4
CVE-2025-31203	18.0 to 18.5	Apple, fixed in iOS 18.4
CVE-2025-31250	18.4 to 18.7.2	Apple macOS only, fixed in macOS Sequoia 15.5
CVE-2026-10001	26.0 to 26.3	Google Chrome, fixed in 148.0.7778.216

The list calls CVE-2025-31250 a bug in how iOS parses HEVC video. Its CVE record is a macOS privacy fix, with no iOS release listed.

CVE-2026-10001 is the only plugin for iOS 26. The list gives it the top priority, 9, and a reliability of 0.75. Its CVE record is a use-after-free in Google Chrome, published on 28 May 2026.

The plugin file, /plugins/CVE-2026-10001/exploit.js, calls itself a dyld4 hijack "specific to iOS 26". Its default gadget addresses end in counting digits:

    pivot_gadget: 0xFFFFFFF007123456,
    jop_dispatch: 0xFFFFFFF007234568,

The plugin needs a memory read and write from an earlier stage. The server's browser stages stop at iOS 18.

Impact

Exposure: every visitor on iOS 13 to 18.7 who reaches the landing page is routed to Coruna or DarkSword stages. A visitor on iOS 26 gets the fake check, and the router logs the visit and loads no chain.

The router fetches /profiles/c10_deploy.json fresh on every visit. A change to that file applies from the next page load.

Indicators of compromise (IOCs)

Network indicators

Indicator	Context
154.222.16[.]220	Landing page, router, chain stages and logging
hxxps://154.222.16[.]220/profiles/c10_deploy.json	C10 switch
hxxps://154.222.16[.]220/profiles/ios_187_gray_gate.json	iOS 18.7 allowlist
hxxps://154.222.16[.]220/gooll/gooll.html	DarkSword production page
hxxps://154.222.16[.]220/gooll/lab_187.html	DarkSword lab page for iOS 18.6.3 to 18.7
hxxps://154.222.16[.]220/api/plugins/list	Plugin list
hxxps://154.222.16[.]220/logs?id=-1&text=lp-router	Router logging

File hashes (SHA-256)

SHA-256	File
24bf40a618f164223b7e8d32b3f7fc4f9110b4c304189306790d39355f0901f3	Landing page, also served at /C10/b.html
7cb1f1eb8a181b4c25e1c6308498361c604edc91466522848cc29f954fa10429	/client/chain/ios_chain_routing.js
3c4e1d343a98b45e2dc405760b6582178d6c646a67e3ae1bf582e29638a21ff0	/client/lp-router.js
fda9ab968518d9e1cb50af5582a94dc0bb444320c0c302260d957a22dbf89756	/client/chain_status_banner.js
0f7db28dd72dca3a2964d30ff7b4f28cd97016fb6a738c8a7c58bbe5896a9cfb	/src/recaptcha.config.js
1d3734079bc317dbf56f5c8eba3e532f85ea7d55f4c53da4b3db979ded62d961	/src/recaptcha.js
cb6671cfb92db0a321a23667b4250b5774283ac042a3e42a3d768315b4778d11	/profiles/c10_deploy.json
0d7aea9d04dbc98f8bbb3f3c9c754f1fecff2b78be276b5a790b0c7bdbe2230f	/profiles/ios_187_gray_gate.json
349a2aa3510e01bcfe9662d6df4a61673b0b94008dd620ec88717bfe4d9d0bbf	/api/plugins/list
9259130c2ecbcf754bc7dd1ba8dedf0f74c612396032f89df43b562fd44e1856	/plugins/CVE-2026-10001/exploit.js
64ef647cdf099c39b0482a2cbe5137674068d623a8906e25666db93e059d2401	/plugins/CVE-2025-31250/exploit.js
83a06c02d0d09a672d027a0067e1c59c995b27ac56539f662ed451a78d8720ef	/gooll/gooll.html
cc6538afe5dd755854fe9f853241b6c0fcffcc9e183468261f42b24666b4d7de	/gooll/lab_187.html
db7ec0a17ca52d28ceed5351902e39e48bf3a0ae335c7a1803b51960d7287559	/gooll/rce_loader.js