Coruna exploit kit targeted iPhones running iOS 13 to 17.2.1

What happened

Google's Threat Intelligence Group disclosed Coruna, an iOS exploit kit with five full exploit chains and 23 exploits. It was used in turn by a surveillance vendor's customer, a suspected Russian espionage group (UNC6353) and a financially motivated group based in China (UNC6691).

The kit backs off when the iPhone is in Lockdown Mode or the user is browsing privately.

What was found

Victims were reached through hidden frames on compromised Ukrainian websites, fake Chinese sites mostly about finance, and a fake WEEX crypto exchange pop-up. The final payload, PlasmaLoader, goes after 18 crypto wallet apps. Google says the kit does not work on the latest iOS, and in March 2026 Apple brought the fixes to older devices in iOS 15.8.7 and 16.7.15.

Data at risk

• Crypto wallet apps
• Wallet funds

What you should do

1. 1Update to the latest iOS.
2. 2On an iPhone that stays on iOS 15 or 16, install 15.8.7 or 16.7.15.
3. 3Turn on Lockdown Mode if the iPhone cannot be updated.