{"id":232646,"date":"2026-03-06T01:22:21","date_gmt":"2026-03-06T07:22:21","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/03\/spyware-grade-coruna-ios-exploit-kit-now-used-in-crypto-theft-attacks"},"modified":"2026-03-06T01:22:21","modified_gmt":"2026-03-06T07:22:21","slug":"spyware-grade-coruna-ios-exploit-kit-now-used-in-crypto-theft-attacks","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/03\/spyware-grade-coruna-ios-exploit-kit-now-used-in-crypto-theft-attacks","title":{"rendered":"Spyware-grade Coruna iOS exploit kit now used in crypto theft attacks"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/spyware-grade-coruna-ios-exploit-kit-now-used-in-crypto-theft-attacks2.jpg\"><\/a><\/p>\n<p>A previously undocumented set of 23 iOS exploits named \u201cCoruna\u201d has been deployed by multiple threat actors in targeted espionage campaigns and financially motivated attacks.<\/p>\n<p>The Coruna kit contains five full iOS exploit chains, the most sophisticated leveraging non-public techniques and mitigation bypasses, for iOS versions 13.0 through 17.2.1 (released in December 2023).<\/p>\n<p>Google Threat Intelligence Group (GTIG) researchers first observed activity related to the Coruna exploit kit in February 2025, in activity attributed to a surveillance vendor customer.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A previously undocumented set of 23 iOS exploits named \u201cCoruna\u201d has been deployed by multiple threat actors in targeted espionage campaigns and financially motivated attacks. The Coruna kit contains five full iOS exploit chains, the most sophisticated leveraging non-public techniques and mitigation bypasses, for iOS versions 13.0 through 17.2.1 (released in December 2023). Google Threat [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1511],"tags":[],"class_list":["post-232646","post","type-post","status-publish","format-standard","hentry","category-surveillance"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/232646","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=232646"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/232646\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=232646"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=232646"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=232646"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}