Is Your iPhone Vulnerable to Coruna iOS Exploit Kit? How To Protect iPhones as US Govt Hacking Tools Leaked to Cybercriminals
Security researchers from Google Threat Intelligence and iVerify have identified "Coruna," a sophisticated exploit kit targeting iPhones running iOS 13 to 17.2.1. Linked to leaked US government frameworks, the tool has proliferated among Russian espionage groups and Chinese cybercriminals.
Mumbai, March 5: A sophisticated iOS exploit kit dubbed "Coruna," which reportedly shares structural similarities with hacking frameworks used by the United States government, has been discovered in the wild. Research published by Google Threat Intelligence Group and security firm iVerify indicates that these high-level Coruna iOS Exploit Kit surveillance tools have transitioned from state-sponsored operations into the hands of diverse threat actors, including Russian espionage groups and financially motivated criminals in China.
As per Google Threat Intelligence post, the exploit kit is designed to bypass iPhone security defences through "watering hole" attacks, where victims simply need to visit a compromised website to have their devices infected. According to technical data, the kit contains five full exploit chains and 23 individual exploits, allowing hackers to maintain access even if Apple patches specific vulnerabilities. While the tools were initially tracked in targeted surveillance operations in early 2025, they have since been observed in broad-scale campaigns targeting Ukrainian users and users of fake cryptocurrency exchanges. What Is AI-Based Biometric Scam? Hyderabad Police Issue Urgent Advisory as Cybercriminals Target Facial and Voice Data for Deepfake Identity Theft.
Global Proliferation of State-Level Exploits
The discovery of Coruna highlights a growing and unregulated market for "second-hand" zero-day exploits. Security analysts noted that the framework’s transition from a commercial surveillance vendor to Russian group UNC6353 and later to Chinese actor UNC6691 suggests a rapid leak or sale of sensitive digital weaponry. iVerify researchers warned that the more widespread the use of such tools becomes, the more certain a leak to unscrupulous bad actors will occur.
Evidence suggests that components of the Coruna kit were previously utilised in "Operation Triangulation," a hacking campaign identified in 2023. At that time, reports emerged that the US government had attempted to breach iPhones belonging to specific employees. The current version of the kit is highly engineered, featuring fingerprinting modules to identify specific iPhone models and obfuscation techniques to hide its activities from traditional security scans.
Vulnerable Devices and Protective Measures
The threat is currently limited to older software versions, specifically affecting devices running iOS 13.0 through to iOS 17.2.1. iPhones updated to iOS 17.3 or later versions are generally considered protected, as Apple addressed a key vulnerability, CVE-2024-23222, in early 2024. Google security experts have added all identified malicious domains to their Safe Browsing service to mitigate further spread. CVE-2026-2441: Google Chrome Gets Latest Security Update, Fixes Highly Vulnerable Zero-Day Flaw Exploited by Hackers; Check More Details.
How to Be Safe Against Coruna iOS Exploit Kit
For individuals unable to update their devices to the latest software, security experts strongly recommend enabling "Lockdown Mode." The Coruna kit is programmed to automatically "bail out" or cease its infection process if it detects that a device has Lockdown Mode active or if the user is browsing in a private window. This discovery underscores the critical importance of regular software updates as the primary defence against increasingly commoditised state-level hacking tools.
(The above story first appeared on LatestLY on Mar 05, 2026 12:45 PM IST. For more news and updates on politics, world, sports, entertainment and lifestyle, log on to our website latestly.com).