Google uncovers Coruna iOS Exploit Kit targeting iOS 13–17.2.1

Google’s Threat Intelligence Group discovered “Coruna” (CryptoWaters), a highly capable iOS exploit kit comprising five exploit chains and 23 exploits that targets iOS 13.0–17.2.1, abuses WebKit RCEs, PAC and PPL/kernel bypasses, and deploys a loader (PlasmaLoader) that installs a financial/crypto-focused infostealer; the kit has been observed in targeted surveillance, Ukrainian watering-hole attacks, and broad Chinese financial scams, with Google publishing IOCs and YARA rules.