Apple iPhone Hacking Kit Used By Spies, Crypto Scams Could Have US Intelligence Origins

Google’s Menace Intelligence Group (GTIG) has uncovered a robust iPhone hacking toolkit able to infecting units when a consumer visits a malicious web site, which means malware might be transferred with out something being clicked on by the goal.

The framework, dubbed “Coruna,” contains 5 full iOS exploit chains and 23 vulnerabilities concentrating on iPhones working iOS 13 by means of 17.2.1. Researchers stated a few of the exploits depend on beforehand unseen methods to bypass Apple’s safety protections.

GTIG first recognized components of the toolkit in early 2025 in an exploit chain utilized by a buyer of an unnamed business surveillance vendor. The code used a JavaScript framework that fingerprinted units to find out the iPhone mannequin and working system model earlier than delivering a tailor-made exploit.

The identical framework later appeared on compromised Ukrainian web sites in mid‑2025. Google attributed that marketing campaign to UNC6353, a suspected Russian espionage group, which used hidden iframes to selectively goal visiting iPhone customers.

Later within the yr, researchers found the toolkit once more on a whole bunch of Chinese language‑language web sites tied to cryptocurrency and finance scams. These websites tried to lure victims to go to utilizing iOS units earlier than injecting the exploit package.

The report stated vulnerabilities utilized by Coruna have since been patched in newer variations of Apple’s cellular working system and urged customers to replace their units. The exploit package doesn’t work in opposition to the most recent variations of iOS.

Doable U.S. origins

Whereas GITG’s report doesn’t determine the unique surveillance vendor buyer or who might have developed the package, researchers for cellular safety agency iVerify researchers stated components of the code recommend doable U.S. origins.

“It is extremely refined, took hundreds of thousands of {dollars} to develop, and it bears the hallmarks of different modules which were publicly attributed to the U.S. authorities,” iVerify co-founder Rocky Cole told WIRED. He added that it was the primary instance uncovered by the agency of “very possible U.S. authorities instruments” being adopted by adversaries and cybercriminal teams after “spinning uncontrolled.”

iVerify estimated roughly 42,000 units in only one marketing campaign had been compromised after analyzing site visitors to command‑and‑management servers linked to Chinese language‑language rip-off web sites distributing the exploits.

The toolkit targets vulnerabilities in Apple’s WebKit browser engine and features a loader that deploys completely different exploit chains relying on the gadget mannequin and working system model. Payloads are encrypted, compressed and delivered in a customized file format designed to evade detection.

“iPhone customers are strongly urged to replace their units to the most recent model of iOS,” GTIG stated, including that Apple’s Lockdown Mode can present further safety if updating just isn’t doable.