An iOS exploit framework has revealed how advanced mobile attack tools can move rapidly from surveillance operations to espionage and financial crime.
Google’s Threat Intelligence Group (GTIG) identified Coruna, a powerful exploit kit containing 23 vulnerabilities across five exploit chains that were used to compromise thousands of iPhones throughout 2025.
“The core technical value of this exploit kit lies in its comprehensive collection of iOS exploits, with the most advanced ones using non-public exploitation techniques and mitigation bypasses,” said the researchers.
Inside the Coruna iOS Exploit Framework
According to Google’s Threat Intelligence Group (GTIG), Coruna was capable of targeting Apple devices running iOS versions released between September 2019 and December 2023.
Researchers uncovered the toolkit after a threat actor mistakenly deployed a debug version of the framework, inadvertently exposing internal code names and documentation embedded within the exploit kit.
The discovery provided rare insight into how the framework was structured and how its exploit chains were designed to target different iOS versions.
Tracking Coruna Across Multiple Threat Actors
GTIG researchers were also able to track Coruna across three separate threat actor ecosystems throughout 2025, offering an unusual glimpse into how sophisticated exploit frameworks circulate across the cyber threat landscape.
In many cases, advanced tools initially developed for surveillance purposes are later reused or repurposed by state-sponsored espionage groups and eventually by financially motivated cybercriminals.
Coruna’s Multi-Stage Attack Campaign
The earliest observed activity involving Coruna occurred in February 2025, when researchers identified components of an exploit chain delivered through a previously unknown JavaScript framework.
The code was designed to fingerprint visiting devices by identifying the iPhone model and installed iOS version before delivering a tailored exploit.
Once a compatible target was identified, the framework triggered a WebKit remote code execution (RCE) vulnerability followed by a Pointer Authentication Code (PAC) bypass, enabling attackers to execute malicious code on the device and advance further along the exploitation chain.
By summer 2025, the same infrastructure appeared in campaigns linked to a Russian espionage group tracked as UNC6353.
In this phase, attackers injected malicious code into dozens of compromised Ukrainian websites spanning industries such as retail, industrial services, and e-commerce.
The exploit chain was delivered through a hidden iFrame hosted on the domain cdn.uacounter[.]com.
To reduce detection and increase targeting precision, the exploit was selectively triggered only for iPhone users located within specific geographic regions.
In late 2025, researchers discovered the complete Coruna exploit kit being used in a campaign attributed to a financially motivated Chinese threat group tracked as UNC6691.
In this stage, attackers deployed the exploit across a network of fraudulent cryptocurrency and financial websites designed to lure victims into visiting the pages from an iPhone.
One example involved a fake website impersonating the WEEX cryptocurrency exchange, which displayed pop-up prompts encouraging users to access the platform from their mobile devices in order to trigger the exploit chain.
How the Coruna Exploit Kit Works
At its core, Coruna contains 23 exploits organized into five full attack chains, allowing attackers to progress from an initial browser compromise to full device control.
The framework combines multiple vulnerability classes, including WebKit memory corruption flaws, sandbox escape vulnerabilities, privilege escalation techniques, and Page Protection Layer (PPL) bypasses that allow attackers to gain deeper control over the operating system.
Key vulnerabilities used in the exploit framework include:
Two exploits within the framework — Photon and Gallium — were previously associated with Operation Triangulation, the high-profile iOS espionage campaign uncovered by Kaspersky in 2023.
Their reuse in Coruna demonstrates how threat actors often combine previously discovered vulnerabilities with new exploitation techniques to construct more advanced and reliable attack frameworks.
How Coruna Steals Cryptocurrency
After the exploit chain successfully compromises a device, Coruna deploys a final-stage payload known as PlasmaLoader, tracked by researchers as PLASMAGRID.
The malware injects itself into powerd, a root-level iOS system daemon, while masquerading as a legitimate Apple service identifier to evade detection.
Once installed, the malware focuses primarily on financial theft.
Researchers found that PlasmaLoader can hook functions in at least 18 cryptocurrency wallet applications, including MetaMask, Phantom, and BitKeep, allowing attackers to intercept sensitive wallet data.
The malware also scans Apple Notes for BIP39 seed phrases or keywords such as “backup phrase” and “bank account,” which could allow attackers to recover cryptocurrency wallets and steal digital assets.
Despite the sophistication of the exploit framework, Google researchers note that Coruna is not effective against the latest versions of iOS, underscoring the importance of keeping mobile devices fully updated to protect against known vulnerabilities.
How Security Teams Can Reduce Mobile Risk
Because the attack relies on multiple vulnerabilities, web-based delivery, and post-exploitation data theft, effective defenses require a layered mobile security strategy.
- Ensure all iPhones are updated to the latest iOS version and enforce automatic patching through mobile device management (MDM).
- Enable Apple Lockdown Mode on high-risk or executive devices, as Coruna terminates exploitation when this feature is active.
- Deploy mobile threat defense (MTD) solutions integrated with MDM to detect exploit attempts, suspicious behavior, and anomalous network activity.
- Monitor network traffic for indicators of compromise, including connections to suspicious *.xyz domains and unusual HTTP headers such as sdkv or x-ts.
- Restrict access to unverified financial and cryptocurrency websites and limit installation of high-risk applications such as crypto wallets on corporate devices.
- Harden enterprise iOS configurations by enforcing app allowlists, restricting untrusted profiles, and limiting unnecessary device services or sharing features.
- Regularly test incident response plans and mobile security playbooks to ensure teams can quickly detect, investigate, and contain mobile device compromise.
By implementing these measures, organizations can limit the potential blast radius of mobile compromises while building resilience.
Why Mobile Devices Remain a Growing Attack Surface
The Coruna campaign illustrates how advanced exploit frameworks can move between different threat actors and use cases over time, from surveillance operations to espionage and financially motivated activity.
As mobile devices store corporate data, credentials, and financial applications, they remain an important part of the enterprise attack surface.
For security teams, the case reinforces the importance of managing smartphones as enterprise endpoints with consistent patching, visibility, and security controls.
As organizations strengthen mobile security and endpoint visibility, many are also turning to zero trust solutions to help enforce continuous verification and tighter access controls across their environments.
