Coruna: five iOS chains and 23 exploits targeting iPhones

On 3 March 2026 Google Threat Intelligence Group described Coruna, a mature iOS exploit kit containing five complete chains and 23 exploits. The framework targeted iPhones running iOS 13.0 through 17.2.1. It first appeared in operations by a surveillance-vendor customer, later in watering holes targeting Ukrainian users, and finally at broad scale on fake Chinese financial sites.

The story is larger than one CVE. It illustrates a secondary market for advanced techniques: a capability built for narrow operations can migrate into state espionage and then financially motivated campaigns. GTIG did not establish exactly how proliferation occurred, so the evidence supports observed reuse, not a definitive sale by a named vendor.

Anatomy of a Coruna chain

After a victim reached an infected site, JavaScript fingerprinted the device, model and iOS release. The server selected an appropriate WebKit RCE, Pointer Authentication Code and PPL bypasses, then a loader and implant. This was an adaptive chain rather than one payload sent to every visitor.

GTIG mapped components to CVE-2024-23222, CVE-2023-32434, CVE-2023-41974, CVE-2023-38606, CVE-2024-23225 and CVE-2024-23296, while some elements had no public CVE. An older identifier does not mean the kit merely copied a basic public exploit: its value included non-public bypass techniques and robust integration.

The framework stopped when it detected Lockdown Mode or private browsing. A hardcoded cookie derived resource URLs using sha256(COOKIE + ID)[:40]. Binary blobs used custom 0xf00dbeef headers, LZW compression, ChaCha20 with a unique key per blob and .min.js filenames. File extension therefore did not describe the content.

From surveillance to financial theft

Google captured part of a surveillance-customer chain in February 2025. In summer, identical JavaScript appeared in hidden iframes on compromised Ukrainian sites and was selectively delivered by geography; GTIG tracked the suspected Russia-nexus operator as UNC6353. By year end, the kit appeared across fake financial and cryptocurrency sites in activity attributed to financially motivated China-based UNC6691.

The final PlasmaLoader/PLASMAGRID used identifier com.apple.assistd and injected into root daemon powerd. The payload searched for financial data, decoded QR codes from images and scanned text for BIP39 sequences and phrases such as “backup phrase” and “bank account”. It could download extra modules, while configuration included hardcoded C2 and a DGA seeded with lazarus to generate .xyz domains.

What defenders can observe

Conventional EDR visibility on iOS is limited, so defence combines version compliance, network telemetry, device management and user risk. Update to current iOS: Google said Coruna did not work against the latest version at publication. High-risk individuals should enable Lockdown Mode; the kit’s deliberate exit when detecting it is practical campaign-specific evidence of value.

Enterprise controls include:

• enforce a minimum iOS version through MDM and block non-compliant access;
• monitor DNS/HTTP against current GTIG indicators and Safe Browsing;
• inspect .min.js responses with binary entropy rather than trust extensions;
• scan corporate sites for unauthorised iframes and scripts;
• train high-risk users on Lockdown Mode and separate devices;
• treat wallet theft as device compromise, not only an app incident.

Indicators age quickly. DGA and changing infrastructure reduce blocklist value. Behavioural signals — hidden iframes, fingerprint-driven resource sequences, binary responses disguised as JavaScript and new .xyz names resolved through a public resolver — age better.

Respond to a suspected iPhone

Do not instinctively wipe before evidence collection. Remove logical access to corporate resources, preserve MDM, DNS, proxy and identity logs, and record version and timing. Route high-risk cases to mobile forensics under a defined chain of custody. Rotate tokens and credentials from a clean endpoint.

Updating closes vulnerabilities but does not prove implant removal. For credible full-chain evidence, restore through an Apple-supported process, re-enrol and limit data restoration. Cryptocurrency assets need a new seed created on a trusted device; changing the wallet app password does not protect an exposed recovery phrase.

Core lesson

Coruna industrialises mobile exploitation: fingerprinting, chain selection, mitigation bypass, loader and modular payload form one product. Defenders cannot win by tracking one CVE. They need rapid updates, MDM version enforcement, high-risk user protection, website monitoring and a mobile IR process.

Connect this strategy with smartphone security, mobile application testing and threat intelligence. For mobile exposure and response design, contact BreachRoad.

---

Primary source: Google Threat Intelligence Group — Coruna.