Details have emerged regarding an exploit kit named Coruna, which poses a significant threat to iPhones operating on older versions of iOS, specifically from iOS 13 to iOS 17.2.1. This kit exploits a total of 23 vulnerabilities through five full iOS exploit chains, as highlighted in a recent post by Google's Threat Intelligence Group on the Google Cloud Blog.
The mechanism of Coruna involves visiting a malicious website where hidden JavaScript assesses the device's security settings. This allows the exploit to navigate around essential iOS protections, potentially granting high-level privileges to install malware capable of data collection or downloading additional harmful modules. Notably, the exploit is designed to abort if the device is in Lockdown Mode or if the user is browsing in private mode.
Furthermore, iVerify, a mobile security firm, has indicated that the design of Coruna appears to derive from tools associated with the US government, suggesting a troubling intersection of cybercrime and state-sponsored hacking. Their analysis indicates that this represents the first widespread exploitation of mobile devices, including iOS, by a criminal organization utilizing nation-state tools.