Coruna Spyware Framework Hits iPhones With 23 iOS Exploits

A powerful exploit framework called Coruna iOS Exploit Kit has been discovered targeting Apple iPhones running iOS versions 13.0 through 17.2.1. According to researchers from Google’s Google Threat Intelligence Group (GTIG), the exploit kit contains 23 different vulnerabilities organized into five complete exploit chains, making it one of the most advanced iOS attack tools observed in recent years.

Security experts say the toolkit, also known as CryptoWaters, is not effective against the latest versions of iOS. However, it poses a serious risk to millions of devices still running older versions of the operating system.

The discovery highlights a growing cybersecurity concern: advanced spyware and surveillance tools are increasingly being reused and circulated among different threat actors, including nation-state attackers and financially motivated cybercriminals.

The Coruna exploit kit is a sophisticated framework designed to exploit multiple vulnerabilities in Apple’s iOS operating system. Researchers found that it includes five full exploit chains and 23 individual exploits capable of attacking iPhones running various versions of iOS.

Unlike traditional malware, this exploit kit is highly structured and engineered, combining multiple attack techniques into a single system. According to GTIG, the toolkit integrates several non-public exploitation techniques and advanced mitigation bypass methods that allow attackers to bypass Apple’s built-in security protections.

The framework connects all the exploit components through a shared infrastructure, allowing threat actors to easily deploy different exploits depending on the victim’s device configuration.

The attack begins with a custom JavaScript framework designed to collect information about the target device. When a victim visits a compromised website, the framework performs device fingerprinting to determine whether the visitor is using an iPhone or iPad.

The script collects important details such as:

• Device model

• iOS version

• Browser environment

• Security settings

Once the system confirms that the device is a real iPhone and identifies its operating system version, it loads the appropriate WebKit remote code execution (RCE) exploit.

Many of these attacks rely on vulnerabilities in WebKit, the browser engine used by Apple’s Safari browser.

One key vulnerability exploited by the toolkit is CVE-2024-23222, a type confusion bug that could allow attackers to execute malicious code remotely. Apple patched this vulnerability in January 2024 through updates to iOS 17.3 and related versions.

After executing the WebKit exploit, the attack chain continues with additional techniques such as Pointer Authentication Code (PAC) bypass, allowing attackers to gain deeper control over the device.

Researchers found that the exploit kit changed hands multiple times during 2025, demonstrating the existence of a thriving market for high-end cyberattack tools.

According to GTIG, the toolkit followed this path:

1. Early 2025: Used by a commercial surveillance vendor

2. Mid 2025: Acquired by a government-backed threat actor

3. Late 2025: Used by financially motivated cybercriminals operating from China

Although the exact method of transfer remains unknown, the findings suggest that second-hand zero-day exploit markets are becoming more active, enabling multiple attackers to reuse the same vulnerabilities.

Security company iVerify described Coruna as one of the clearest examples of spyware-grade capabilities moving from surveillance companies to nation-state actors and eventually criminal groups.

In July 2025, researchers observed the exploit framework being distributed through compromised websites hosted on the domain cdn.uacounter[.]com.

The malicious code was injected into legitimate Ukrainian websites related to:

• Industrial equipment

• Retail tools

• Local services

• E-commerce platforms

Visitors accessing these websites from an iPhone unknowingly triggered a hidden iFrame, which loaded the exploit framework.

The campaign is believed to be linked to a suspected Russian espionage group tracked as UNC6353.

Interestingly, the exploit was only delivered to selected iPhone users located in specific geographic regions, indicating highly targeted attacks.

Another wave of attacks appeared in December 2025, when researchers discovered a network of fake Chinese websites designed to deliver the Coruna exploit kit.

These websites mostly focused on financial services and investment platforms. They encouraged visitors to open the pages using an iPhone or iPad for a “better user experience.”

Once the victim visited the site using an iOS device, the page injected a hidden iFrame that loaded the exploit kit.

This campaign is linked to a threat cluster identified as UNC6691.

Unlike the earlier campaign, these attacks did not restrict victims based on geographic location, allowing wider distribution of the exploit kit.