Coruna: A very powerful iOS exploit kit

Google’s Threat Intelligence Group (GTIG) has uncovered a massive new iOS exploit kit dubbed “Coruna”. The malware targets Apple iPhone models running iOS 13.0 through to iOS 17.2.1, Coruna is a formidable threat armed with 23 distinct exploits and five complete exploit chains.

A Timeline of Proliferation

• February 2025: GTIG first identified fragments of the exploit chain being utilised in highly targeted operations by a customer of a commercial surveillance vendor (The malware is widely believed to have been developed for the US government). The exploits were wrapped in a unique JavaScript framework designed to fingerprint devices.
• Summer 2025: The kit then resurfaced in the hands of UNC6353, a suspected Russian espionage group. They deployed Coruna in watering hole attacks targeting Ukrainian users, hiding the malicious framework within compromised local websites ranging from retail tools to industrial equipment.
• Late 2025: Finally, the complete exploit kit was acquired by UNC6691, a financially motivated threat actor operating out of China. This group deployed Coruna on a massive scale, using hidden iFrames injected into fake cryptocurrency exchange websites to trap unsuspecting victims.

Under the Bonnet

The framework driving Coruna is exceptionally well-engineered. When a user visits a compromised site, the kit actively fingerprints the device and will immediately halt the attack if it detects the user is in Private Browsing mode or is using Apple’s Lockdown mode.

If the device is vulnerable, the malware delivers unencrypted Remote Code Execution (RCE) and Pointer Authentication Code (PAC) bypasses. It then deploys a binary loader that pulls down heavily obfuscated payloads that are encrypted with the ChaCha20 encryption algorithm. The malware is compressed and tailored specifically to the target’s iOS version and internal chipset. Notably, the threat actors utilised powerful vulnerabilities, including CVE-2024-23222, a zero-day vulnerability which was patched by Apple in January 2024.

As mentioned above, the malware utilises 23 exploits to bypass device security, evade discovery, elevate privilege levels, and maintain persistence

Despite its origins in the surveillance sector, Coruna’s final payload is strictly financial. Tracked by GTIG as PLASMAGRID, the stager binary injects itself into a root-level iOS daemon with its primary goal being cryptocurrency theft.

The payload is capable of decoding QR codes from saved images and scanning Apple Memos for word sequences or specific keywords like “bank account” and “backup phrase”. The malware also remotely downloads modules designed specifically to hook into and exfiltrate data from popular crypto wallets, including MetaMask, Trust Wallet, and Exodus.

According to GTIG, the developers of the malware left behind internal logs written in Chinese, with some code comments featuring emojis and syntax suggesting they may have been generated by an LLM. The malware also uses a custom domain generation algorithm (DGA) seeded with the word “lazarus” as a fallback mechanism to maintain contact with its command and control servers.

How to Protect Your Device

Google has shared its research to raise industry awareness and has already added all identified malicious domains to Safe Browsing to safeguard users.

Because the Coruna exploit kit relies on older vulnerabilities and is not effective against the latest Apple software, the absolute most effective defence is to update your iPhone to the latest version of iOS. For those users who are unable to update their devices for any reason, enabling Apple’s Lockdown Mode is strongly recommended, as the exploit kit is programmed to automatically bail out when this enhanced security feature is active.