Coruna: The iOS Exploit Kit That Went From Spyware Vendor to Mass Crypto Theft

TL;DR

On March 3–4, 2026, Google Threat Intelligence Group (GTIG) and iVerify independently published research on Coruna — a sophisticated iOS exploit kit containing 23 exploits across 5 full exploit chains, targeting iPhones running iOS 13.0 through 17.2.1.

What makes Coruna remarkable isn’t just its technical depth — it’s the proliferation story. The kit traveled from a commercial surveillance vendor, to a suspected Russian espionage group targeting Ukraine, to a Chinese cybercrime operation mass-deploying it to steal cryptocurrency wallets.

The Proliferation Timeline

The journey of Coruna illustrates how advanced offensive capabilities trickle down from state-level operations to mass cybercrime.

Three distinct phases were observed:

1. Feb 2025 — Commercial Surveillance Vendor Customer: GTIG first captured parts of an iOS exploit chain being used by a customer of a surveillance company. The exploits were wrapped in a previously unseen JavaScript framework with unique obfuscation techniques.

2. Summer 2025 — Russian Espionage (UNC6353): The same framework appeared on cdn.uacounter[.]com, loaded as a hidden iFrame on compromised Ukrainian websites — industrial equipment, retail, local services, and e-commerce sites. It targeted selected iPhone users from specific geolocations in a classic watering hole attack. GTIG worked with CERT-UA to clean up all compromised websites.

3. Late 2025 — Chinese Cybercrime (UNC6691): The full exploit kit surfaced on a massive network of fake Chinese financial websites (fake crypto exchanges, gambling sites). Unlike the previous targeted deployments, this was indiscriminate — any iPhone visitor with a vulnerable iOS version got exploited.

How the kit changed hands between these groups remains unclear, but it points to an active secondary market for exploit capabilities.

How Coruna Works: The Exploit Framework

The Coruna framework is well-engineered with several notable design choices:

• Lockdown Mode aware: Bails out if the device has Lockdown Mode enabled or if the user is in private browsing
• Fingerprinting first: Collects device model, iOS version, and other data points to determine if the target is a real device
• Version-matched exploits: Based on fingerprinting, loads the appropriate WebKit RCE and PAC bypass for the specific iOS version

The JavaScript framework uses simple but unique obfuscation — XOR-encoded strings and integer obfuscation:

1
2
3
4
5
6
7

// String obfuscation example from Coruna
[16, 22, 0, 69, 22, 17, 23, 12, 6, 17].map(x => {
  return String.fromCharCode(x ^ 101);
}).join("")

// Integer obfuscation
i.p1 = (1111970405 ^ 1111966034);

Binary Payload Packaging

After the WebKit RCE and PAC bypass execute in the browser, the kit loads binary payloads with a distinctive packaging format:

• Files served from URLs ending in .min.js (masquerading as JavaScript)
• Custom file format with 0xf00dbeef magic header
• ChaCha20 encryption with unique per-blob keys
• LZW compression
• Metadata indicating supported chip architectures and iOS versions

The Five Exploit Chains

Coruna contains 23 individual exploits organized into 5 full chains covering iOS 13 through 17.2.1. Each chain follows the same pattern:

WebKit RCE → PAC Bypass → Sandbox Escape → Privilege Escalation → PPL Bypass

WebKit Remote Code Execution (WebContent R/W)

PAC Bypass

Sandbox Escape

Privilege Escalation (Kernel)

PPL Bypass

Notable overlap: The Photon and Gallium exploits target the same vulnerabilities used as zero-days in Operation Triangulation (discovered by Kaspersky in 2023). This suggests the Coruna developers either independently discovered the same bugs or had access to the same vulnerability research.

Delivery: Fake Crypto Sites at Scale

The UNC6691 (Chinese cybercrime) deployment was the most aggressive. Fake cryptocurrency exchange websites — impersonating platforms like WEEX — used social engineering to get users to visit on their iPhones.

Once an iPhone visited the site, a hidden iFrame injected the full Coruna exploit kit — no user interaction required beyond the initial page visit.

The network traffic during an active exploitation looks like this — showing the sequential loading of the fingerprinting module, RCE, PAC bypass, and encrypted binary payloads:

The Implant: PLASMAGRID

After full exploitation, a stager binary called PlasmaLoader (tracked as PLASMAGRID) is deployed. The infection chain works in stages:

Stage 1 — PlasmaLoader (powerd)

The loader uses com.apple.assistd as its identifier and injects itself into powerd, a daemon running as root on iOS. This is the initial foothold.

Stage 2 — C2 Check-in

The implant contacts the C2 server, retrieves a configuration file from /details/show.html, and downloads additional modules. The config and modules are packaged as 7-ZIP archives with a unique hard-coded password, with JSON configuration listing module URLs, hashes, and sizes.

Stage 3 — CorePayload (locationd)

A third-stage implant is loaded into locationd. This component:

• Starts regular heartbeat check-ins with a separate C2 domain
• Retrieves module configuration listing available plugins
• Loads modules for imagent (sms.js) and SpringBoard (helion.js)
• Inspects photos and Apple Notes on the device
• Injects unsigned dylibs into running processes

Module Injection

The imagent module takes over C2 communication and has a fallback option to communicate via SMS/iMessage. The SpringBoard component maintains a communication channel back to locationd.

What It Steals

The payload is laser-focused on cryptocurrency. It targets 17 crypto wallet apps:

• MetaMask, Phantom, Trust Wallet, Exodus
• Bitkeep, Bitpie, Coin98, Coinbase Wallet
• imToken, Krystal, MyTonWallet, Solflare
• Ronin (Skymavis), TonHub, Tonkeeper
• TronLink, Uniswap

It can also:

• Decode QR codes from images on disk (looking for wallet seed phrases)
• Scan Apple Notes for BIP39 mnemonic words, “backup phrase”, or “bank account” keywords
• Upload matching content to the C2

The implant modules contain logging strings in Chinese, suggesting the UNC6691 operators’ origin:

<PlasmaLogger> %s[%d]: CorePayload 管理器初始化成功，尝试启动...
// "CorePayload Manager initialized successfully, attempting to start..."

DGA Fallback

If hard-coded C2 servers go down, the implant has a domain generation algorithm (DGA) using the string lazarus as a seed to generate 15-character .xyz domains. It validates generated domains using Google’s public DNS resolver.

Detection: How to Find Coruna Infections

iVerify’s independent analysis (they internally called it CryptoWaters) identified several forensic artifacts:

Filesystem Indicators

• /private/var/tmp/pl.sp.exec.guard.lock — temporary, deleted on reboot
• /private/var/mobile/Library/Preferences/com.apple.photolibraryd.plist — persistent, survives reboot, backed up to iTunes. This file does not normally exist on iOS devices.

Process Behavior

Look for these thread names in sysdiagnose/stacks.ips:

Network Indicators

• Static User-Agent that doesn’t match the actual iOS version
• Multiple different User-Agents for the same process (locationd) — each with different iOS version strings
• HTTP HEAD requests to C2 followed by config retrieval from /details/show.html

Log Messages

1

failed lookup: name = com.plasma.springboard.ipc, flags = 0x1, requestor = locationd[69], error = 3: No such process

Forensic Sources for Investigation

• Crashlogs — look for com.apple.WebKit.WebContent, powerd, panic
• Sysdiagnose — thread names, stacks
• Safari Browser History — infection URL will be present in encrypted backups
• OSAnalyticsADDaily.plist, DataUsage.db, NetUsage.db, Powerlogs — evidence of powerd and imagent activity

Key IOCs

File Hashes (Implant & Modules)

Network IOCs (Selected)

UNC6353 (Russia/Ukraine watering hole):

• cdn[.]uacounter[.]com

UNC6691 (Chinese crypto scam):

• ai-scorepredict[.]com
• goodcryptocurrency[.]top
• binancealliancesintro[.]com
• ios[.]teegrom[.]top
• i[.]binaner[.]com

PLASMAGRID DGA domains (seed: “lazarus”):

• vvri8ocl4t3k8n6.xyz
• rlau616jc7a7f7i.xyz
• ol67el6pxg03ad7.xyz
• 6zvjeulzaw5c0mv.xyz

Full IOC list available in the GTIG GTI Collection and iVerify’s STIX2 feed.

YARA Rules

GTIG published two YARA rules for detection:

rule G_Hunting_Exploit_MapJoinEncoder_1 {
  meta:
    author = "Google Threat Intelligence Group (GTIG)"
  strings:
    $s1 = /\[[^\]]+\]\.map\(\w\s*=>.{0,15}String\.fromCharCode\(\w\s*\^\s*(\d+)\).{0,15}\.join\(""\)/
    $fp1 = "bot|googlebot|crawler|spider|robot|crawling"
  condition:
    1 of ($s*) and not any of ($fp*)
}

rule G_Backdoor_PLASMAGRID_Strings_1 {
  meta:
    author = "Google Threat Intelligence Group (GTIG)"
  strings:
    $ = "com.plasma.appruntime.appdiscovery"
    $ = "com.plasma.appruntime.downloadmanager"
    $ = "com.plasma.appruntime.hotupdatemanager"
    $ = "com.plasma.appruntime.modulestore"
    $ = "com.plasma.appruntime.netconfig"
    $ = "com.plasma.bundlemapper"
    $ = "com.plasma.event.upload.serial"
    $ = "com.plasma.notes.monitor"
    $ = "com.plasma.photomonitor"
    $ = "com.plasma.PLProcessStateDetector"
    $ = "plasma_heartbeat_monitor"
    $ = "plasma_injection_dispatcher"
    $ = "plasma_ipc_processor"
    $ = "plasma_%@.jpg"
    $ = "/var/mobile/Library/Preferences/com.plasma.photomonitor.plist"
    $ = "helion_ipc_handler"
    $ = "PLInjectionStateInfo"
    $ = "PLExploitationInterface"
  condition:
    1 of them
}

What To Do

1. Update iOS immediately. Coruna does not work against the latest iOS versions. If you’re on anything below iOS 17.3, you are potentially vulnerable.
2. Enable Lockdown Mode if you cannot update. The exploit kit explicitly checks for it and bails out.
3. Check your device using the iVerify Basic App (free) which can scan for Coruna/CryptoWaters indicators.
4. Monitor forensic artifacts listed above if you manage a fleet of iOS devices.

The Bigger Picture

Coruna demonstrates a troubling pattern in the exploit marketplace:

• Capability proliferation is real: Tools built for targeted surveillance end up in mass cybercrime campaigns. The same exploit chain used to target Ukrainian government interests was later deployed indiscriminately against anyone visiting a fake crypto site.
• iOS is not immune: Five full exploit chains covering 4+ years of iOS versions shows sustained, well-funded development.
• The secondary market is active: How the kit moved from a surveillance vendor’s customer to a Russian espionage group to a Chinese cybercrime operation remains unknown — but the fact that it did suggests an active trade in “second-hand” zero-day capabilities.

References

1. Google Threat Intelligence Group (GTIG) — Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit (March 4, 2026)
2. iVerify — Coruna: Inside the Nation-State-Grade iOS Exploit Kit We’ve Been Tracking (March 3, 2026)

All figures in this post are sourced from the Google GTIG publication referenced above.