An iOS exploit framework has revealed how advanced mobile attack tools can move rapidly from surveillance operations to espionage and financial crime.
Google’s Threat Intelligence Group (GTIG) identified Coruna, a powerful exploit kit containing 23 vulnerabilities across five exploit chains that were used to compromise thousands of iPhones throughout 2025.
“The core technical value of this exploit kit lies in its comprehensive collection of iOS exploits, with the most advanced ones using non-public exploitation techniques and mitigation bypasses,” the researchers said.
Inside the Coruna iOS exploit framework
According to Google’s Threat Intelligence Group (GTIG), Coruna was capable of targeting Apple devices running iOS versions released between September 2019 and December 2023.
Researchers uncovered the toolkit after a threat actor mistakenly deployed a debug version of the framework, inadvertently exposing internal code names and documentation embedded within the exploit kit.
The discovery provided rare insight into how the framework was structured and how its exploit chains were designed to target different iOS versions.
Tracking Coruna across multiple threat actors
GTIG researchers were also able to track Coruna across three distinct threat-actor ecosystems throughout 2025, offering an unusual glimpse into how sophisticated exploit frameworks circulate across the cyber threat landscape.
In many cases, advanced tools initially developed for surveillance purposes are later reused or repurposed by state-sponsored espionage groups and eventually by financially motivated cybercriminals.
Coruna’s multi-stage attack campaign
The earliest observed activity involving Coruna occurred in February 2025, when researchers identified components of an exploit chain delivered through a previously unknown JavaScript framework.
The code was designed to fingerprint visiting devices by identifying the iPhone model and installed iOS version before delivering a tailored exploit.
Once a compatible target was identified, the framework triggered a WebKit remote code execution (RCE) vulnerability followed by a Pointer Authentication Code (PAC) bypass, enabling attackers to execute malicious code on the device and advance further along the exploitation chain.
By summer 2025, the same infrastructure appeared in campaigns linked to a Russian espionage group tracked as UNC6353.
In this phase, attackers injected malicious code into dozens of compromised Ukrainian websites spanning industries such as retail, industrial services, and e-commerce. The exploit chain was delivered through a hidden iFrame hosted on the domain cdn.uacounter[.]com.
To reduce detection and increase targeting precision, the exploit was selectively triggered only for iPhone users located within specific geographic regions.
In late 2025, researchers discovered the complete Coruna exploit kit being used in a campaign attributed to a financially motivated Chinese threat group tracked as UNC6691. In this stage, attackers deployed the exploit across a network of fraudulent cryptocurrency and financial websites designed to lure victims to visit the pages on an iPhone.
One example involved a fake website impersonating the WEEX cryptocurrency exchange that displayed pop-up prompts encouraging users to access the platform on their mobile devices to trigger the exploit chain.
How the Coruna exploit kit works
At its core, Coruna contains 23 exploits organized into five full attack chains, allowing attackers to progress from an initial browser compromise to full device control.
The framework combines multiple vulnerability classes, including WebKit memory-corruption flaws, sandbox-escape vulnerabilities, privilege-escalation techniques, and Page Protection Layer (PPL) bypasses that allow attackers to gain deeper control over the operating system.
Key vulnerabilities used in the exploit framework include:
- CVE-2021-30952 – WebKit read/write vulnerability
- CVE-2023-32409 – Sandbox escape vulnerability
- CVE-2023-32434 – Privilege escalation flaw
- CVE-2024-23222 and CVE-2024-23225 – Page Protection Layer (PPL) bypass techniques
Two exploits within the framework — Photon and Gallium — were previously associated with Operation Triangulation, the high-profile iOS espionage campaign uncovered by Kaspersky in 2023.
Their reuse in Coruna demonstrates how threat actors often combine previously discovered vulnerabilities with new exploitation techniques to construct more advanced and reliable attack frameworks.
How security teams can reduce mobile risk
Because the attack relies on multiple vulnerabilities, web-based delivery, and post-exploitation data theft, effective defenses require a layered mobile security strategy.
- Ensure all iPhones are updated to the latest iOS version and enforce automatic patching through mobile device management (MDM).
- Enable Apple Lockdown Mode on high-risk or executive devices, as Coruna terminates exploitation when this feature is active.
- Deploy mobile threat defense (MTD) solutions integrated with MDM to detect exploit attempts, suspicious behavior, and anomalous network activity.
- Monitor network traffic for indicators of compromise, including connections to suspicious *.xyz domains and unusual HTTP headers such as sdkv or x-ts.
- Restrict access to unverified financial and cryptocurrency websites, and limit the installation of high-risk applications, such as crypto wallets, on corporate devices.
- Harden enterprise iOS configurations by enforcing app allowlists, restricting untrusted profiles, and limiting unnecessary device services or sharing features.
- Regularly test incident response plans and mobile security playbooks to ensure teams can quickly detect, investigate, and contain mobile device compromise.
By implementing these measures, organizations can limit the potential blast radius of mobile compromises while building resilience.
Editor’s note: This article originally appeared on our sister website, eSecurityPlanet.
