Coruna Exploit Kit With 23 Exploits Hacked Thousands of iPhones

Google's Threat Intelligence Group (GTIG) has identified the Coruna iOS exploit kit, a sophisticated attack framework containing 23 exploits across five full exploit chains. This kit compromised thousands of iPhones running iOS versions from 13.0 to 17.2.1 in 2025.

The Coruna exploit kit targets Apple iPhone models from iOS 13.0 (Sep 2019) to iOS 17.2.1 (Dec 2023). It was unveiled when a threat actor inadvertently deployed a debug version, revealing internal code names and identities. The kit includes extensive documentation in English and utilizes non-public exploitation techniques and mitigation bypasses, characteristic of nation-state-grade tools.

GTIG tracked Coruna's progression through three distinct threat actor ecosystems in 2025, providing insight into the proliferation of elite exploit kits from commercial surveillance vendors to state-sponsored espionage groups, and eventually to financially motivated criminals.

February 2025 – Commercial Surveillance Customer: GTIG identified parts of an iOS exploit chain delivered via a new JavaScript framework using unique obfuscation techniques, which fingerprinted devices to identify iPhone models and iOS versions before deploying a WebKit remote code execution (RCE) exploit and a Pointer Authentication Code (PAC) bypass. Summer 2025 – Russian Espionage (UNC6353): The same JavaScript framework was found on cdn.uacounter[.]com , injected as a hidden iFrame across compromised Ukrainian websites. Exploits were selectively delivered based on geolocation to iPhone users. GTIG alerted CERT-UA to remediate the affected websites. Late 2025 – Chinese Financial Fraud (UNC6691): The complete exploit kit was found on fake Chinese financial and cryptocurrency sites targeting iOS users, with pop-ups specifically urging visits via iPhone.

The 23 exploits deliver WebKit RCE, PAC bypasses, sandbox escapes, privilege escalation (PE), and Page Protection Layer (PPL) bypasses. Key CVEs include:

Type Code Name Targeted iOS Versions CVE

WebContent R/W buffout 13 → 15.1.1 CVE-2021-30952

WebContent R/W jacurutu 15.2 → 15.5 CVE-2022-48503

WebContent R/W terrorbird 16.2 → 16.5.1 CVE-2023-43000

WebContent R/W cassowary 16.6 → 17.2.1 CVE-2024-23222

Sandbox Escape IronLoader 16.0 → 16.3.1 CVE-2023-32409

PE Photon 14.5 → 15.7.6 CVE-2023-32434

PPL Bypass Gallium 14.x CVE-2023-38606

PPL Bypass Sparrow 17.0 → 17.3 CVE-2024-23225

PPL Bypass Rocket 17.1 → 17.4 CVE-2024-23296

Two exploits, Photon and Gallium, target vulnerabilities previously used in Operation Triangulation, an iOS espionage campaign.

PlasmaLoader: The Financial Theft Payload

The final stage of the exploit chain involves a stager binary called PlasmaLoader (PLASMAGRID), which injects itself into the powerd iOS daemon, using com.apple.assistd as an identifier. This payload targets 18 cryptocurrency wallet applications by hooking their functions to exfiltrate sensitive data. It can also scan Apple Notes for BIP39 seed phrases and keywords like "backup phrase" or "bank account." The code comments are in Chinese, indicating Chinese-speaking developers.

Network communication is encrypted with HTTPS using AES, and a custom Domain Generation Algorithm (DGA) seeded with "lazarus" generates fallback .xyz domains validated via Google's public DNS resolver.

GTIG has added all identified domains and websites to Google Safe Browsing. The Coruna exploit kit is ineffective against the latest iOS version. It is recommended to:

Update all iPhones to the latest iOS version immediately. Enable Lockdown Mode if updating is not possible; Coruna exits when Lockdown Mode is detected. Avoid unverified financial/crypto websites accessed via mobile Safari. Monitor for unusual network requests to .xyz domains or HTTP headers sdkv and x-ts as potential indicators.

Based on reporting by Cyber Security News.