Google iVerify Disclose Coruna iPhone Exploit Toolkit

Security researchers from Google and mobile security firm iVerify have disclosed details of a sophisticated iPhone hacking toolkit known as Coruna, which exploits multiple vulnerabilities in older versions of Apple's iOS operating system and has proliferated from potential government surveillance use to criminal operations targeting cryptocurrency users.

The toolkit, first identified by Google's Threat Intelligence Group in February 2024, chains five separate exploit paths that leverage a total of 23 vulnerabilities to bypass iOS security protections. These flaws, many of which have been patched by Apple, affect iPhones running iOS versions from 13, released in September 2019, to 17.2.1, issued in December 2023. According to Google, the exploits enable remote code execution simply by visiting a malicious website, where hidden JavaScript first assesses the device's model, iOS version, and security settings before deploying tailored attacks. The process progressively escalates privileges, evades sandbox restrictions, and installs malware capable of extracting sensitive data.

Coruna's journey began in early 2024 with its deployment by a customer of a commercial surveillance vendor,...