Google stated it recognized a “new and highly effective” exploit package dubbed Coruna (aka CryptoWaters) concentrating on Apple iPhone fashions working iOS variations between 13.0 and 17.2.1.
The exploit package featured 5 full iOS exploit chains and a complete of 23 exploits, Google Menace Intelligence Group (GTIG) stated. It is not efficient towards the newest model of iOS. The findings had been first reported by WIRED.
“The core technical worth of this exploit package lies in its complete assortment of iOS exploits, with probably the most superior ones utilizing personal exploitation methods and mitigation bypasses,” in response to GTIG. “The framework surrounding the exploit package is extraordinarily properly engineered; the exploit items are all related naturally and mixed collectively utilizing widespread utility and exploitation frameworks.”
The package is alleged to have circulated amongst a number of risk actors since February 2025, transferring from a business surveillance operation to a government-backed attacker, and eventually, to a financially motivated risk actor working from China by December.
It is at present not identified how the exploit package modified arms, however the findings level to an energetic marketplace for second-hand zero-day exploits, permitting different risk actors to reuse them for their very own goals. In a associated report, iVerify stated the exploit package is similar to earlier frameworks developed by risk actors affiliated with the U.S. authorities.
“Coruna is among the most important examples we have noticed of subtle spyware-grade capabilities proliferating from business surveillance distributors into the arms of nation-state actors and in the end mass-scale legal operations,” iVerify stated.
The cellular safety vendor stated the usage of the subtle exploit framework marks the primary noticed mass exploitation towards iOS units, indicating that spy ware assaults are shifting from being extremely focused to broad deployment.
Google stated it first captured components of an iOS exploit chain utilized by a buyer of an unnamed surveillance firm early final yr, with the exploits built-in right into a never-before-seen JavaScript framework. The framework is designed to fingerprint the machine to find out if it is actual and collect particulars, together with the particular iPhone mannequin and iOS software program model it’s working.
The framework then masses the suitable WebKit distant code execution (RCE) exploit primarily based on the fingerprint knowledge, adopted by executing a pointer authentication code (PAC) bypass. The exploit in query pertains to CVE-2024-23222, a kind confusion bug in WebKit that was patched by Apple in January 2024 with iOS 17.3 and iPadOS 17.3 and iOS 16.7.5 and iPadOS 16.7.5.
Quick ahead to July 2025, the identical JavaScript framework was detected on the area “cdn.uacounter[.]com,” which was loaded as a hidden iFrame on compromised Ukrainian web sites. This included web sites catering to industrial gear, retail instruments, native providers, and e-commerce. A suspected Russian espionage group named UNC6353 is assessed to be behind the marketing campaign.
What’s fascinating concerning the exercise was that the framework was delivered solely to sure iPhone customers from a particular geolocation. The exploits deployed as a part of the framework consisted of CVE-2024-23222, CVE-2022-48503, and CVE-2023-43000, the final of which is a use-after-free flaw in WebKit.
It is price noting that CVE-2023-43000 was addressed by Apple in iOS 16.6 and iPadOS 16.6, launched in July 2023. Nonetheless, the safety launch notes had been up to date to incorporate an entry for the vulnerability solely on November 11, 2025.
The third time the JavaScript framework was detected within the wild was in December 2025. A cluster of faux Chinese language web sites, most of them associated to finance, had been discovered to drop the iOS exploit package after instructing customers to go to them from an iPhone or iPad for a greater consumer expertise. The exercise is attributed to a risk cluster tracked as UNC6691.
As soon as these web sites are accessed through an iOS machine, a hidden iFrame is injected to ship the Coruna exploit package containing CVE-2024-23222. The exploit supply, on this case, was not constrained by any geolocation standards.
Additional evaluation of the risk actor’s infrastructure led to the invention of a debug model of the exploit package, together with numerous samples protecting 5 full iOS exploit chains. A complete of 23 exploits spanning variations from iOS 13 to iOS 17.2.1 have been recognized.
Among the CVEs exploited by the package and the corresponding iOS variations they focused are listed under –
“Photon and Gallium are exploiting vulnerabilities that had been additionally used as zero-days as a part of Operation Triangulation,” Google stated. “The Coruna exploit package additionally embeds reusable modules to ease the exploitation of the aforementioned vulnerabilities.”
In June 2023, the Russian authorities claimed the marketing campaign was the work of the U.S. Nationwide Safety Company, accusing it of hacking “a number of thousand” Apple units belonging to home subscribers and international diplomats as a part of a “reconnaissance operation.”
UNC6691 has been noticed weaponizing the exploit to ship a stager binary codenamed PlasmaLoader (aka PLASMAGRID) that is designed to decode QR codes from photos and run further modules retrieved from an exterior server, permitting it to exfiltrate cryptocurrency wallets or delicate data from numerous apps like Base, Bitget Pockets, Exodus, and MetaMask, amongst others.
“The implant accommodates a listing of hard-coded C2s however has a fallback mechanism in case the servers don’t reply,” GTIG added. “The implant embeds a customized area era algorithm (DGA) utilizing the string ‘lazarus’ as a seed to generate a listing of predictable domains. The domains could have 15 characters and use .xyz as a TLD. The attackers use Google’s public DNS resolver to validate if the domains are energetic.”
A notable side of Coruna is that it skips execution on units in Lockdown Mode, or if the consumer is in non-public looking. To counter the risk, iPhone customers are suggested to maintain their units updated, and allow Lockdown Mode for enhanced safety.
