A previously undocumented set of 23 iOS exploits named “Coruna” has been deployed by multiple threat actors in targeted espionage campaigns and financially motivated attacks.

The Coruna kit contains five full iOS exploit chains, the most sophisticated leveraging non-public techniques and mitigation bypasses, for iOS versions 13.0 through 17.2.1 (released in December 2023).

Google Threat Intelligence Group (GTIG) researchers first observed activity related to the Coruna exploit kit in February 2025, in activity attributed to a surveillance vendor customer.