Apple iPhone Hacking Kit Used By Spies, Crypto Scams Could Have US Intelligence Origins

Google Uncovers Sophisticated iOS Exploit Kit 'Coruna'

Google's Threat Intelligence Group (GTIG) has identified a powerful iPhone hacking toolkit named 'Coruna,' capable of infecting devices through malicious websites without requiring user interaction. The framework contains five full iOS exploit chains and 23 vulnerabilities affecting iPhones running iOS versions 13 through 17.2.1, with some exploits employing novel techniques to bypass Apple's security measures.

Exploitation and Attribution

GTIG first detected components of Coruna in early 2025, used by a customer of a commercial surveillance vendor. Later, the same framework appeared on compromised Ukrainian websites in mid-2025, attributed to suspected Russian espionage group UNC6353, which used hidden iframes to target iPhone users. Subsequently, the toolkit was found on numerous Chinese-language websites associated with cryptocurrency and finance scams, luring iOS users to exploit kit-infected sites.

While GTIG's report does not pinpoint the original developer, mobile security firm iVerify suggests potential U.S. origins based on code elements. iVerify co-founder Rocky Cole noted the sophistication and cost of development, stating it bears hallmarks of publicly attributed U.S. government modules. iVerify estimates that approximately 42,000 devices were compromised in a single campaign linked to Chinese scam websites distributing the exploits.

Technical Details and Recommendations

Coruna targets vulnerabilities in Apple's WebKit browser engine. It utilizes a JavaScript framework to fingerprint devices and deliver tailored exploits. The toolkit's payloads are encrypted, compressed, and delivered in a custom file format to evade detection. The vulnerabilities exploited by Coruna have since been patched in newer iOS versions, and the exploit kit is ineffective against the latest releases.

GTIG strongly advises iPhone users to update their devices to the latest iOS version. For users unable to update, Apple's Lockdown Mode is recommended as an additional protective measure.