{"id":11097,"date":"2026-03-04T10:04:15","date_gmt":"2026-03-04T10:04:15","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/03\/04\/coruna-exploit-kit-with-23-exploits-hacked-thousands-of-iphones\/"},"modified":"2026-03-04T10:04:15","modified_gmt":"2026-03-04T10:04:15","slug":"coruna-exploit-kit-with-23-exploits-hacked-thousands-of-iphones","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/03\/04\/coruna-exploit-kit-with-23-exploits-hacked-thousands-of-iphones\/","title":{"rendered":"Coruna Exploit Kit With 23 Exploits Hacked Thousands of iPhones"},"content":{"rendered":"

Coruna Exploit Kit With 23 Exploits Hacked Thousands of iPhones
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Google\u2019s Threat Intelligence Group (GTIG) has uncovered Coruna, a sophisticated iOS exploit kit<\/a> containing 23 exploits across five full exploit chains that compromised thousands of iPhones running iOS 13.0 through 17.2.1 throughout 2025.<\/p>\n

The Coruna exploit kit is an advanced, modular iOS attack framework discovered by GTIG targeting Apple iPhone models from iOS 13.0 (September 2019) to iOS 17.2.1 (December 2023).<\/p>\n

The kit\u2019s name was uncovered when one threat actor mistakenly deployed a debug version of the framework, exposing internal code names and the kit\u2019s own identity.<\/p>\n

Its exploits feature extensive documentation written in native English, with the most advanced components leveraging non-public exploitation techniques and mitigation bypasses, a hallmark of nation-state-grade tooling.<\/p>\n

Three-Phase Exploit Timeline<\/strong><\/h2>\n

GTIG tracked Coruna moving through<\/a> three distinct threat actor ecosystems over the course of 2025, a rare window into how elite exploit kits proliferate from commercial surveillance vendors to state-sponsored espionage groups and finally to financially motivated criminals.<\/p>\n