What is the Coruna iOS exploit kit?

A JavaScript-powered beast with 23 exploits targeting iOS 13-17.2.1, chaining RCE to full compromise. Started in surveillance, spread to state hackers and scammers.

Does Coruna work on latest iOS versions?

No — patched out. But update immediately; enable Lockdown Mode otherwise.

How did Coruna proliferate to threat actors ?

Likely black market sales or leaks, from vendors to Russians (UNC6353) to Chinese (UNC6691). Active zero-day trade evident.

🎯 Threat Intelligence

Coruna: The iOS Exploit Kit That Went From Spy Weapon to Scam Bait

A shadowy JavaScript framework slithers onto your iPhone screen — boom, 23 exploits unleash hell on iOS from 13 to 17.2. Google just pulled back the curtain on Coruna, the kit that's rewriting the rules of digital black markets.

theAIcatchup Apr 08, 2026 4 min read

Timeline graphic of Coruna iOS exploit kit discovery and proliferation

⚡ Key Takeaways

Coruna features 5 exploit chains and 23 exploits, targeting iOS 13.0 to 17.2.1 with advanced bypasses. 𝕏
Proliferated from commercial surveillance to Russian espionage (UNC6353) and Chinese financial scams (UNC6691). 𝕏
iPhone users must update to latest iOS; Lockdown Mode recommended for high-risk scenarios. 𝕏

Published by

theAIcatchup

Threat intelligence. Zero noise.

#Coruna exploit kit #exploit proliferation #iOS zero-days #threat actors

Worth sharing?

Get the best Cybersecurity stories of the week in your inbox — no noise, no spam.

Originally reported by Mandiant Blog

⚡ Key Takeaways

The 60-Second TL;DR

theAIcatchup

Share this article

Worth sharing?

Related Stories

Redirects Power 21% of Phishing Emails in Early 2026 – Why We're Still Sleeping on It

$21 Billion Vanishes: FBI's Grim Cybercrime Tally for 2025

Infostealers Eclipse Banking Trojans: Financial Cyberthreats Reshape in 2025

Cisco Source Code Vanishes in TeamPCP's Trivy Supply Chain Heist

Stay in the loop