Coruna Exploit Kit With 23 Exploits Hacked Thousands of iPhones

Google Threat Intelligence Group uncovered 'Coruna', a modular iOS exploit kit (23 exploits, five full chains) used in 2025 against iOS 13.0–17.2.1. The kit propagated across three actor ecosystems—from a commercial surveillance customer to Russian espionage (UNC6353) and Chinese-financial fraud (UNC6691)—and culminates in the PlasmaLoader payload that hooks crypto wallets and scans for seed phrases; mitigations recommended include updating iOS and enabling Lockdown Mode.