iPhone users targeted with iOS exploit chain in fake government notices

Threat actors impersonating the Italian government-backed SEND digital notification service target iPhone users with a multi-stage iOS exploit chain.

The malicious site can silently load Safari/WebKit exploits against devices running iOS versions up to 17.2.1 while also attempting to steal personal and payment information.

According to D3Lab, this is the first campaign it has documented in the Italian threat landscape combining a conventional phishing lure with an embedded iOS exploitation framework. Victims first encounter a fake anti-bot check before being shown a cloned SEND portal, while an iframe loads exploit code from separate infrastructure in the background.

SEND, operated by Italian payments technology company pagoPA, is used by public administrations to deliver legally valid notifications to citizens and businesses. Neither pagoPA nor SEND is involved in the campaign, and their branding is being used without authorization.

The phishing frontend uses Socket.IO and encrypted application messages, allowing operators to interact with sessions in real time. Its code includes forms for collecting personal information, addresses, phone numbers, email addresses, payment cards, and verification codes.

More unusually, an embedded iframe connects to a separate server that fingerprints the visitor and selects an exploit based on the detected iOS version.

D3Lab found a three-stage chain associated with the publicly circulated Coruna Pro V2 toolkit. Stage 1 targets WebKit and includes modules for iOS 13 through 17.2.1. Stage 2 attempts to bypass Pointer Authentication Code protections, while Stage 3 seeks to escape Safari's sandbox and execute additional payload functionality.

The loader stops on versions newer than iOS 17.2.1 and also checks for simulators and Lockdown Mode. Researchers noted retry logic, crash counters, and fallback paths, suggesting the exploit framework remains unreliable on some device and software combinations.

If exploitation succeeds, the malware attempts to collect browser and device information and can target sensitive iOS databases containing SMS messages, contacts, call history, Safari history, photos, health information, and Keychain data. It also contains procedures targeting WhatsApp and other messaging and wallet applications, along with a remote JavaScript execution function.

The exploit and command-and-control infrastructure exposed several management services. Assets on the server linked the operation to the Telegram handle @ojishu and used Chinese-language branding, although D3Lab said this is insufficient to determine the operator's identity or nationality.

Seven recovered exploit modules were byte-for-byte identical to files from a public Coruna Pro V2 repository, while other components contained additional telemetry, command execution, crash handling, and data-theft functionality.

Users can significantly reduce exposure by installing the latest iOS updates. People at elevated risk can also consider Apple's Lockdown Mode. SEND notifications should be accessed only through the official portal at cittadini.notifichedigitali.it rather than links delivered through unsolicited messages.