Apple Backports Security Fixes for Older iPhones Targeted by the Coruna Exploit Kit — Update Now If You Have an iPhone 6s Through iPhone X

Coruna is not a typical piece of mobile malware. It is a professional-grade exploit framework originally developed by or for a commercial surveillance vendor, the kind of organization that sells spyware tools to government clients. Researchers first observed it in February 2025 being used by a customer of an unnamed surveillance company. By July 2025 it was being used in watering hole attacks against Ukrainian websites by a suspected Russian espionage group. By December 2025 it had spread further — fake Chinese financial and cryptocurrency websites were delivering it to iPhone users who visited them on their devices. The kit works by fingerprinting a visitor's device — silently checking the iPhone model, iOS version, and security settings from a malicious webpage — and then delivering the precise exploit chain that matches that specific device. It contains 23 individual exploits organized into five complete chains, allowing it to target virtually any iPhone running iOS 13.0 through 17.2.1. The vulnerabilities it exploits include WebKit memory corruption flaws, a kernel use-after-free bug, and two exploits originally weaponized as zero-days in Operation Triangulation — the 2023 campaign that targeted iPhones belonging to Russian users and was later attributed by Russia to US intelligence services.

What makes this situation particularly serious is the trajectory of the Coruna exploit kit. It began as an expensive, targeted surveillance tool used against specific high-value individuals. It then moved into the hands of state-linked espionage groups conducting broader campaigns. By December 2025 it was being used by financially motivated criminals targeting ordinary users through fake gambling and cryptocurrency websites. This is a documented pattern with sophisticated exploit frameworks — they start targeted, they get shared or leaked, and eventually they get used in mass attacks. The fact that Apple is now backporting fixes to iOS 15 and iOS 16 devices is an acknowledgment that real users on older hardware are being actively targeted. CISA added three of the CVEs exploited by Coruna to its Known Exploited Vulnerabilities catalog on March 5, 2026, with a mandatory patch deadline of March 26, 2026 for US federal agency devices — a strong signal that this threat is real and ongoing.