OTX Threat: DarkSword/Coruna Open Directory Finding

Five hosts exposed the complete DarkSword/Coruna iOS exploitation platform through open directories, revealing an active commercial exploitation-as-a-service operation. The platform targets cryptocurrency wallets across 18 different applications, extracting BIP39 recovery phrases and conducting automated theft. Analysis of the production server recovered 11 victim recovery phrases, 179 device loot CVEs: CVE-2025-31200, CVE-2025-24201, CVE-2026-31001