Google’s Threat Intelligence Group (GTIG) and mobile security company iVerify jointly disclosed on March 3, 2026, the discovery of an advanced iOS exploit kit named “Coruna”. The toolkit was originally a government-level hacking tool (originally used by intelligence and police agencies), but has now flowed into the hands of Russian espionage organizations and Chinese cybercriminals, leaving more than 42,000 old iPhones at risk. It was characterized as “the first known large-scale iOS security incident in history.”
Scale of impact and affected versions: More than 42,000 devices compromised
According to a joint investigation by Google’s Threat Intelligence Team and iVerify, the Coruna exploit kit targets iOS 13.0 through iOS 17.2.1, covering a large number of older iPhone devices still in use. iVerify estimated based on command and control server (C2) connections that at least 42,000 devices were compromised. This is the first time such a large-scale iOS zero-day vulnerability attack has been fully documented by security researchers.
Researchers pointed out that the actual number of infections may be higher because some devices may no longer be connected to the C2 server or the attackers may have wiped out relevant traces. Not only did this attack have a wide impact, the “Watering Hole Attack” technique it used was also extremely covert. The attacker first invaded a specific website and implanted malicious code into it. When victims visit these compromised websites, the attack program executes automatically without the user having to click on any links or download files.
Technical analysis: 23 vulnerabilities connected in series to form a digital master key
Coruna iOS Exploit Kit contains 23 vulnerabilities and 5 complete exploit chains (Exploit Chain). It is one of the most complex iOS attack tools discovered so far. The toolkit integrates multiple major security vulnerabilities, including WebKit remote code execution (RCE) vulnerability and sandbox escape (Sandbox Escape) technology. Coruna uses multiple known WebKit vulnerabilities for initial compromise, including CVE-2024-23222, CVE-2022-48503, and CVE-2023-43000. After successfully breaking through the browser sandbox, the attacker then used CVE-2023-32409 (codename IronLoader) to escape the sandbox, and used CVE-2023-38606 (codename Gallium) to bypass Apple’s PPL (Pointer Authentication Code Protected Layer) protection mechanism.
After a successful intrusion, Coruna will deploy the final payload “PlasmaLoader” (PLASMAGRID), which is a malicious program disguised as the Apple system identification code “com.apple.assistd” to avoid security detection. Its main functions include stealing cryptocurrency wallet information, credit card information, BIP39 mnemonic phrases, and sensitive note content in Apple Memos.
Apple’s ultimate rescue: emergency release of iOS 16.7.15 and 15.8.7 updates
In response to the security crisis caused by the leak of the Coruna vulnerability, Apple officially released an emergency security update on March 12, 2026 for older devices that cannot be upgraded to iOS 18. This update aims to block the above-mentioned critical vulnerabilities and provide critical security protection for affected older devices (it is regarded as the conscience of the industry).
| Updated version | Recommended updates for affected older devices |
|---|---|
| iOS 16.7.15 | iPhone 8、iPhone 8 Plus、iPhone X |
| iOS 15.8.7 | iPhone 6s series, iPhone 7 series, iPhone SE (1st generation), iPad Air 2, iPad mini 4 |
While Apple has for years promised to provide at least five years of security updates, the continued availability of fixes for devices that are 13 years old, such as the iPhone 5s, shows the seriousness of the Coruna incident.
Security experts warn that once national-level cyber weapons are leaked, they may be abused by criminal organizations and pose serious security threats to the general public. Users using older versions of iOS should update to the latest version as soon as possible for complete security protection.
Safety recommendations and protective measures
Because Coruna’s final payload can steal cryptocurrency wallets and financial information, security experts specifically urge users with older iOS devices who engage in cryptocurrency transactions or store sensitive financial information to be particularly vigilant. In addition to performing system updates immediately, you should also consider moving sensitive assets to devices that support the latest hardware protection mechanisms (that is, replacing them with new ones) to reduce security risks.
Source: KOCPC Chinese