A suite of hacking tools known as Coruna, originally developed for government use, has now fallen into the hands of criminals, according to the Google Threat Intelligence Group (GTIG). This exploit kit poses a significant risk, as it has the potential to compromise thousands of iPhones.
GTIG noted that it has tracked the Coruna kit since early 2025. Initially, in February of the previous year, the kit was reported to be employed by a customer of a surveillance company. Subsequently, it was linked to a suspected Russian espionage group targeting users in Ukraine and later emerged in China, where it was utilized in watering hole attacks aimed at stealing cryptocurrency and sensitive information.
The exploit is effective against iPhones running iOS versions from 13.0 to 17.2.1. Users operating the latest iOS version are advised to maintain their updates to safeguard against this threat. Google emphasized the importance of keeping devices updated, suggesting that enabling Lockdown Mode can enhance security when updates are not feasible.