Coruna iOS Exploit Kit Uses 23 Exploits Across Five Chains Targeting iOS 13–17.2.1
Summary: Google Threat Intelligence Group identified an iOS exploit kit called Coruna (aka CryptoWaters) containing five full exploit chains and 23 exploits targeting iOS 13.0 through 17.2.1, which is not effective against the latest iOS version. The kit circulated among threat actors from February 2025, moving from a commercial surveillance operation to a government-backed attacker and then to a financially motivated actor operating from China by December, and CISA added CVE-2021-30952, CVE-2023-41974, and CVE-2023-43000 to its KEV catalog on March 5, 2026 with a March 26, 2026 fix deadline for federal agencies.
Bottom line: iVerify called this the first observed mass exploitation against iOS devices, and the kit is delivered through a zero-dimension hidden iframe that runs in JavaScript and completes in seconds with no user interaction beyond page load. With more than 50 delivery domains identified and the payload injectable anywhere a JavaScript tag can be placed, the exposure is no longer limited to attacker-owned infrastructure.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2022-48503CVE-2023-43000CVE-2024-23222
- Related
- CVE-2023-43000: Apple Multiple products Use-After-Free Vulnerability Known Exploited Vulnerabilities · Mar 05, 2026CVE-2022-48503: Apple Multiple Products Unspecified Vulnerability Known Exploited Vulnerabilities · Oct 20, 2025