Coruna landing kit: platform_module.js fetch from iOS Safari client

Arnold Chan@slaz

•updated 3 days ago•0•0•0

Detects a multi-stage exploit chain targeting iOS Safari clients, characterized by the sequential fetching of specific JavaScript modules (platform_module.js, utility_module.js, Stage1, Stage3, and bootstrap.dylib) and subsequent callback communication to a remote server. This pattern is consistent with a browser-based exploit framework targeting iOS devices.