Coruna: The High-Powered iOS Exploit Kit Proliferating Across the Global Threat Landscape

The Google Threat Intelligence Group (GTIG) has detailed the curtain on “Coruna,” a formidable iOS exploit kit that has transitioned from the hands of commercial surveillance vendors into the arsenals of state-sponsored espionage groups and financially motivated attackers.

First identified targeting iPhone models running iOS 13.0 through 17.2.1, the kit is a masterclass in modern exploitation. As the GTIG report notes, “The core technical value of this exploit kit lies in its comprehensive collection of iOS exploits, with the most advanced ones using non-public exploitation techniques and mitigation bypasses”.

The timeline of the Coruna kit reveals a disturbing trend of high-end cyber capabilities trickling down to various threat actors. In February 2025, GTIG first captured parts of the chain being used by a customer of a commercial surveillance company. By July 2025, the kit surfaced in “watering hole attacks targeting Ukrainian users by UNC6353, a suspected Russian espionage group”. Finally, the complete kit was retrieved during broad-scale campaigns by UNC6691, a China-based threat actor targeting cryptocurrency users.

GTIG warns that this trajectory “suggests an active market for ‘second hand’ zero-day exploits”, where advanced techniques are re-used and modified by multiple actors.

The Coruna kit is a “comprehensive collection” featuring five full exploit chains and a total of 23 exploits. The framework is “extremely well engineered,” utilizing a sophisticated JavaScript delivery system to fingerprint devices before launching the appropriate attack.

Key Exploits Identified:

One of the centerpieces is CVE-2024-23222, a WebKit vulnerability that was addressed by Apple in early 2024 but remained a potent weapon in the Coruna arsenal for unpatched devices.

Unlike typical surveillance tools designed for silent monitoring, the final payload of this kit—a stager called PlasmaLoader—is laser-focused on financial theft.

The malware injects itself into the powerd daemon to run with root privileges. From there, it deploys modules designed to:

• Scan for Secrets: Analyze text for BIP39 recovery phrases or keywords like “bank account” in Apple Memos.
• Decode QR Codes: Extract information from images stored on the device.
• Hook Crypto Apps: Specifically target 19 different cryptocurrency wallet applications, including MetaMask, Trust Wallet, and Phantom, to exfiltrate assets.

Interestingly, researchers found that “all of these modules contain proper logging with sentences written in Chinese”, such as strings indicating the successful initialization of the payload manager. Some internal comments even appeared to be LLM-generated, adding a modern layer to the development process.

While Coruna is a powerful threat, it is ineffective against the latest versions of iOS. Users are strongly urged to update their devices immediately. For high-risk individuals unable to update, GTIG recommends that “Lockdown Mode be enabled for enhanced security”.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy