Coruna iOS Exploit Kit Linked to Operation Triangulation — Millions of iPhones at Risk

Coruna is an advanced iOS exploit kit first documented by Google and iVerify in March 2026. It targets Apple iPhone models running iOS versions between 13.0 and 17.2.1 and contains 23 individual exploits across five complete exploit chains. Among these are CVE-2023-32434 and CVE-2023-38606 — both originally deployed as zero-day vulnerabilities during the 2023 Operation Triangulation campaign, widely considered one of the most sophisticated iPhone attacks ever recorded in computer security history.

The most significant finding from Kaspersky's latest research is that the kernel exploits found inside both Coruna and Operation Triangulation were created by the same developer. According to Boris Larin, principal security researcher at Kaspersky GReAT, all exploits within the Coruna framework are built on an identical kernel exploitation framework and share substantial common code with the original Triangulation campaign tools.

The exploit code includes active support for Apple's A17, M3, M3 Pro, and M3 Max processors along with checks for iOS 17.2 and iOS 16.5 beta 4 — confirming that the original developers are actively maintaining and expanding this codebase in 2026. This level of sustained development is a clear signal of a well-resourced, persistent threat actor operating at the highest levels of internet security and data security compromise. When Coruna was first reported, public evidence was insufficient to directly link it to Triangulation based on shared vulnerabilities alone. The new Kaspersky analysis provides the definitive technical proof of shared authorship that the information security community had been waiting for.

The attack chain begins the moment a user visits a compromised website on Safari. A silent stager immediately fingerprints the browser and operating system and serves the most appropriate exploit from its library. Once delivered, a payload triggers the kernel exploit chain, executes Mach-O loaders and a malware launcher, drops the final implant, and then cleans up all forensic artifacts to eliminate evidence of the intrusion — a sophisticated network security evasion technique that makes detection and attribution extremely difficult.

Coruna has already been actively deployed by multiple threat actors across the cyber attack landscape. A Russia-aligned nation-state actor has used the kit in watering hole attacks targeting organisations and individuals in Ukraine. Separately, criminal groups have deployed it through a cluster of fake Chinese gambling and cryptocurrency websites to deliver a data-stealing malware strain known as PlasmaLoader, also tracked as PLASMAGRID, which silently harvests sensitive user data from compromised devices.

The shift from espionage tool to mass exploitation framework is the critical development here. Any iPhone running iOS 13.0 through 17.2.1 without the latest security patch is potentially exposed. Given that millions of devices globally continue to run older iOS versions due to older hardware, neglected updates, or organisational policy, the attack surface is enormous. Enterprise environments are at particular risk where unmanaged or under-patched personal devices access corporate networks, creating severe data security and computer security vulnerabilities that extend far beyond individual users.

Compounding this threat, the DarkSword iOS exploit kit was leaked publicly on GitHub during the same week, further lowering the barrier for less sophisticated cybercriminals to compromise Apple devices at scale. What was once an exclusive capability requiring nation-state resources is now rapidly becoming accessible to a much broader criminal ecosystem.