Web threats / iOS exploit kits
Coruna iOS exploit kit
Coruna is an iPhone exploit kit loaded through hidden website frames. We have matched its dispatcher and beacon code on 2 sites since 9 October.
Coruna in numbers
Since 9 October, the first Coruna match in our records, counted on 14 October 2026. How we count.
| Sites with Coruna code | 2 |
|---|---|
| Sites with a match in the last 30 days | 2 |
| New sites in September | 0 |
| Still serving it when recaptured at least 25 days later | 0 of 0 sites (0%) |
| Sites running WordPress (captured since 25 September) | 0% |
A one-pixel frame opens the dispatcher
Coruna is an exploit kit targeting iPhones running iOS 13.0 through 17.2.1. Google Threat Intelligence Group's Coruna report describes its browser fingerprinting and selection of an exploit chain for the device.
The injected frame in a compromised page is one pixel wide and high, with aria-hidden="true" and tabindex="-1". It loads hxxps://js[.]apiforxwork[.]com/qqtime/qqtime.html. That wrapper opens hxxps://js[.]apiforxwork[.]net/qqtime/qqtime.html, where a script imports the dispatcher.
obChTK resolves the modules
The script decodes a Base64 dispatcher and installs it as globalThis.obChTK. Its module methods include hPL3On, ZKvD0e, po3QmN and eW4__H. Hash keys identify modules, and salted filenames determine the resources it fetches and runs.
The dispatcher runs in the external frame, so the first-party page source shows only the injected iframe.
The beacon repeats its IP lookup and POST
The appended beacon fetches the visitor's public IP address as text and builds an OS/version description from the user agent. It posts JSON to hxxps://1x8gmjbdq3tepgr[.]icu/api/ip-sync/sync with channelCode, ip, deviceVersion and domain fields.
domain comes from window.location.hostname. In this chain it reads js[.]apiforxwork[.]net, where the frame executes. The timer starts after two seconds and repeats every ten seconds, performing the IP lookup on each pass. A separate timer attempts to reload the parent every two minutes.
What we see
| Month | New sites |
|---|---|
| September | 0 |
| October so far | 2 |
Among successful captures since 25 September, 0 of 1 Coruna sites ran WordPress. Of the 0 sites recaptured at least 25 days after their first match, 0 still served Coruna (0%).
Checking a Coruna injection
Keep the first-party HTML and each document and script loaded through its frames. Look for:
- a one-pixel
aria-hiddenframe loading an externalqqtime/qqtime.htmlpage - a wrapper that opens another frame on a different host
globalThis.obChTKand its hash-keyed module dispatch- JSON POSTs to
/api/ip-sync/syncwith the beacon's field names - recurring IP lookups and parent-reload timers
Remove the frame injection and restore the changed template or HTML from a trusted deployment. Review CMS, hosting and deployment access, rotate affected credentials and clear cached copies. Retest the reported path and follow every frame request it makes.