Coruna: twenty-three exploits, one web page, three kinds of operator

Our assessment: the interesting fact is the hand-off

Individual iPhone bugs are well documented. What Coruna adds is evidence of a second life. According to Google, the same kit was used by different operators with different goals within roughly a year[S1]. The Lab’s assessment is that this matters more than the code: tools built for one customer do not stay with that customer, and the phones that pay for it are the ones left on old software.

How the page decides whether to attack

The kit arrives as a hidden, zero-size frame on a web page, either a compromised site or a lookalike[S2]. Before anything runs, it checks the device. Google reports that it matches the phone’s software to the right chain and that it exits when Lockdown Mode or private browsing is on[S1]. A visit is all that is required; no tap is needed beyond loading the page.

The device check has a consequence for evidence. A phone that does not match may leave a failed attempt, and a phone that matches may leave a success with very little around it.

The anatomy of a chain

An independent reverse engineer who obtained a sample after the public reports presented the kit at Hexacon in Paris on 16 October 2026, and published a written analysis [S4][S5]. The analysis describes the stages in outline. A flaw in the browser’s script engine gives the attacker the ability to read and write memory. A second step defeats pointer authentication, Apple’s protection against redirected code. A loader then runs a second-stage program from memory. A kernel flaw and a bypass of protected memory follow, ending in an implant[S5].

We do not repeat bug-level detail, and the talk did not reveal a new vulnerability. Every component analyzed targets versions Apple fixed long ago, in iOS 17.3 and iOS 17.4[S5]. The value of the work is explanatory: it shows how such chains are assembled, and how many separate defenses an attacker must defeat in sequence.

Why phone attacks come in chains

One bug rarely suffices. Google’s review of 2024 found that exploit chains made of several zero-days were almost exclusively, about 90 percent, used against mobile devices[S9]. Its review of 2025 noted chains that needed three or more vulnerabilities, which raised the number of flaws required for a single objective[S8]. Coruna is the same pattern at product scale: five chains, 23 exploits, each matched to a range of iOS versions.

For defenders the practical consequence is that each update removes not one bug but a link, and a chain with a missing link fails. That is why the kit’s reach tracks software age rather than the importance of the target.

Three kinds of operator

According to Google, parts of the kit were first seen in February 2025. It was then used by a customer of a commercial surveillance vendor. In July 2025 a group Google suspects of espionage deployed it from compromised Ukrainian websites. From December 2025 a financially motivated actor Google describes as China-based used it on fake finance and cryptocurrency sites [S1][S2]. The labels are Google’s assessments, not findings of this Lab.

The last stage differs from classic surveillance. In the financial campaign the implant was built to steal cryptocurrency wallet data and seed phrases rather than to read messages[S1]. The same entry route served three goals, which is why the route, not the goal, is the stable thing to examine.

Who was exposed

The kit covers iOS 13.0 to 17.2.1. Apple’s fixes for the underlying flaws shipped over several years, and in March 2026, after the public reports, Apple extended fixes to older iOS 15 and iOS 16 devices[S3]. CISA added three older Apple vulnerabilities to its catalog of known exploited flaws on 5 March 2026, a date that records when they were listed, not when they were first used[S6]. The exposed population is therefore phones that never moved off older software: spare phones, phones in drawers, devices passed to relatives and, in an examiner’s workload, seized or client phones of uncertain age[S7]. TechCrunch’s reporting quotes security vendors who say phones on iOS 26, and iPhone 17 models with Apple’s newer memory protections, are far harder to attack, while phones on iOS 18 or older stay exposed to leaked chains. That is an expert assessment, not a measurement, and the share of such phones is unknown.

What we could not confirm

Where the kit came from is contested, and this article takes no view. Published assessments conflict, including among researchers at the same company, and the strongest claims rest on anonymous sources. One security vendor published an estimate of how many iPhones were compromised; the estimate has no stated method and we do not use it. We also do not publish the kit’s addresses, file names or code: the original reports carry the indicators.

What this means for examiners

Three questions organize the work. What software was the phone running, and on what date? A phone on iOS 17.4 or later is outside the kit’s published range. What does the browsing record show for the period, and how far back does it go? And is there a reason to expect a record at all? A phone cleared by its owner, or restarted since, may hold little, and that should be stated rather than read as a negative.

Record the iOS version at the start of every examination; for this kit it decides everything. Write the date beside it, because the same phone read a month later may be on a different release, and the question of what it was exposed to depends on the day. Treat a browsing record of a lure page as a lead to corroborate, not a verdict. Ask the owner whether Lockdown Mode was on, and check it. For owners, the advice in the cited reports is the same: update the phone, and where it cannot be updated, retire it from sensitive use or turn on Lockdown Mode [S1][S3].

What the Lab is watching

We are watching three things. First, whether further analyses from Hexacon, including slides and recordings, add artifacts that an examiner could rely on. Second, whether Google or Apple revise their statements on Lockdown Mode and the kit’s exit check. Third, the proportion of phones still on pre-17.3 software, a number no public source gives us. Without it, a kit like this one can be described, but its reach cannot be measured. We will also keep the origin question open until a primary source settles it, and we will say so on this page, with the date, if one does.