Coruna Exploit Targets Millions of iPhones in Sophisticated New Campaign.

Coruna: A New iPhone Exploit Framework

According to Novyny.live: Google's Threat Intelligence Group (GTIG) has identified a new exploit framework, named Coruna, which targets iPhones running iOS versions 13.0 through 17.2.1. This sophisticated toolkit bundles five separate exploit chains and leverages 23 distinct vulnerabilities, posing a significant threat to users. Coruna has been deployed in highly targeted operations, including watering hole attacks specifically aimed at users in Ukraine. This discovery highlights the persistent threat to mobile devices from state-aligned and financially motivated actors.

Attackers utilized a malicious JavaScript framework hosted on the domain cdn.uacounter[.]com. The exploits were delivered selectively to iPhones based on specific geolocation parameters, increasing the likelihood of a successful compromise. By late 2025, the framework had also been deployed on spoofed Chinese websites, broadening its distribution and impact.

Technical Details of the Coruna Attack

Further demonstrating its sophistication, the Coruna payload was tailored to the specific iPhone model and iOS version, indicating a meticulous approach by its operators. The attackers are known to have used a debug version of the exploit, granting them enhanced capabilities for executing attacks. Coruna has become a key tool for financially motivated groups, particularly those based in China, underscoring the critical need for user vigilance in the digital landscape.

This new exploit framework illustrates the growing complexity and targeted nature of cyber threats, especially those directed at mobile devices.

iPhone users should exercise heightened caution against potential attacks, as threat actors are employing advanced methods to harvest data and compromise information. In light of this, adhering to fundamental security practices is essential, including:

• Regularly updating device software to the latest version.
• Exercising caution when visiting unfamiliar or suspicious websites.