CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Coruna iOS Exploit Kit Targets iOS 13–17.2.1 with 23 Exploits

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

Google's Threat Intelligence Group identified the Coruna exploit kit, targeting iOS versions 13.0 to 17.2.1. The kit includes five exploit chains and 23 exploits, some using non-public techniques. It has been used by multiple threat actors, including government-backed groups and financially motivated actors. The kit was first observed in February 2025 and has since been linked to campaigns involving Russian and Chinese actors. The exploit kit leverages vulnerabilities in WebKit and other components, some of which were patched by Apple but remained undocumented until later. The kit is designed to fingerprint devices and deliver appropriate exploits based on the iOS version. It avoids execution on devices in Lockdown Mode or private browsing. The Coruna exploit kit marks a shift from targeted spyware attacks to broader exploitation of iOS devices.

Timeline

  1. 04.03.2026 15:28 1 articles · 4h ago

    Coruna Exploit Kit Used in Multiple Campaigns by Various Threat Actors

    The Coruna exploit kit, first observed in February 2025, has been used by multiple threat actors, including government-backed groups and financially motivated actors. The kit was detected on compromised Ukrainian websites in July 2025 and on fake Chinese websites in December 2025. The kit leverages vulnerabilities in WebKit and other components, some of which were patched by Apple but remained undocumented until later. The kit is designed to fingerprint devices and deliver appropriate exploits based on the iOS version and avoids execution on devices in Lockdown Mode or private browsing. The Coruna exploit kit marks a shift from targeted spyware attacks to broader exploitation of iOS devices.

    Show sources
    Open in new tab

Information Snippets