Spyware-grade Coruna iOS exploit kit now used in crypto theft attacks

Google Threat Intelligence Group (GTIG) uncovered Coruna, a sophisticated iOS exploit kit containing 23 exploits and five full exploit chains that target iOS 13–17.2.1 and use non-public mitigation bypasses; it has been observed in both state-aligned espionage (e.g., UNC6353) and financially motivated campaigns (e.g., UNC6691). The kit fingerprints devices, selects appropriate exploit chains, and can deploy a loader called PlasmaGrid that injects into the iOS root daemon to download modules that steal cryptocurrency wallet recovery phrases and other sensitive data; GTIG published IOCs and recommends updating iOS or enabling Lockdown Mode.