Trending Now - Leaked US Iphone-hacking Tool Poses Risk to National Security

WHO:

Google (organization)

iVerify (mobile security firm)

Russian espionage groups (criminal organization)

Chinese cryptocurrency scammers (criminal organization)

WHAT:

A suite of government hacking tools targeting iPhones has been found in use by cybercriminals.

The hacking toolkit, dubbed "Coruna," uses 23 different vulnerabilities to exploit iPhones.

The toolkit can hijack devices and access sensitive data, including financial information.

The spyware may have infected tens of thousands of phones or more.

The toolkit can be initiated in five different ways, starting with a click on a malicious link.

The exploit kit is designed to circumvent iPhone safeguards.

The Coruna toolkit was first spotted by Google in February 2025.

The toolkit has been used by international cybercriminals, including Russian and Chinese groups.

Coruna can only infect iPhones running older iOS versions between 13 and 17.2.1.

WHERE:

The toolkit has been used globally, with specific mentions of Ukrainian websites being commandeered by Russian espionage groups.

WHEN:

The Coruna toolkit was first identified in February 2025.

In July 2025, a Russian espionage ring used the toolkit against Ukrainian websites.

The latest iOS version, 17.2.1, debuted in 2023.

WHY:

The toolkit was originally built for the US government but was leaked and subsequently used by cybercriminals.

HOW:

The exploit kit is described as a "virtual Trojan Horse" that does not contain specific targeting or one-time links, allowing any visitor to a vulnerable website to be compromised.

Google warns users to update their devices to the latest version of iOS to protect against exploitation.

If upgrading is not possible, users are advised to initiate Lockdown Mode, which Apple rolled out in 2022.

A suite of government hacking tools known as "Coruna" has been discovered in use by cybercriminals, exploiting 23 vulnerabilities in older iPhones to hijack devices and access sensitive data. First identified by Google in February 2025, this toolkit has been utilized by international groups, including Russian espionage rings targeting Ukrainian websites, and can infect phones running iOS versions between 13 and 17.2.1. To protect against this threat, Google advises users to update their devices to the latest iOS version or, if that's not possible, to enable Lockdown Mode, which Apple introduced in 2022.