Coruna Exploit Kit Targets Older iPhones in Multi-Stage Campaigns

Google Threat Intelligence researchers uncovered "Coruna", a highly engineered iOS exploit framework (five exploit chains, 23 vulnerabilities) observed in the wild since 2025 that fingerprints devices, selects compatible WebKit and other iOS exploits, bypasses Apple protections, and drops a loader called PlasmaLoader focused on stealing financial data (QR codes, wallet recovery phrases). The toolkit was linked to a suspected Russian espionage actor (UNC6353) in targeted attacks and later reused in broader financially motivated campaigns (UNC6691); mitigations include Apple updates, enabling Lockdown Mode, and Safe Browsing blocks.