Coruna iOS Exploit Framework: A Threat to Mobile Security
A recent discovery by Google’s Threat Intelligence Group (GTIG) has shed light on the Coruna iOS exploit framework, a powerful tool used to compromise thousands of iPhones. The framework contains 23 vulnerabilities across five exploit chains, allowing attackers to gain full control over the device.
How Coruna Works
Coruna’s exploit kit is designed to target Apple devices running iOS versions released between September 2019 and December 2023. The framework uses non-public exploitation techniques and mitigation bypasses, making it a significant threat to mobile security.
The earliest observed activity involving Coruna occurred in February 2025, when researchers identified components of an exploit chain delivered through a previously unknown JavaScript framework. The code was designed to fingerprint visiting devices, identifying the iPhone model and installed iOS version before delivering a tailored exploit.
Reducing Mobile Risk
To reduce the risk of Coruna, security teams can take several measures, including ensuring all iPhones are updated to the latest iOS version, enabling Apple Lockdown Mode, and deploying mobile threat defense solutions. Additionally, monitoring network traffic for indicators of compromise and restricting access to unverified financial and cryptocurrency websites can help limit the potential blast radius of mobile compromises.
By implementing these measures, organizations can build resilience and protect their mobile devices from the Coruna iOS exploit framework.
Key Takeaways
- Coruna is a powerful iOS exploit framework containing 23 vulnerabilities across five exploit chains.
- The framework is designed to target Apple devices running iOS versions released between September 2019 and December 2023.
- Security teams can reduce mobile risk by ensuring all iPhones are updated, enabling Apple Lockdown Mode, and deploying mobile threat defense solutions.
