Signal
Coruna exploit kit emerges as a major threat to iOS security
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-03-04 13:28 UTCUpdated 2026-03-05 04:04 UTC
rss
securityexploit_kit
Source links open
Source links and full evidence are open here. Archive history, compare-over-time, alerts, exports, API, integrations, and workflow are paid.
No card needed for the free brief.
Evidence trail (top sources)
top sources (4 domains)domains are deduped. counts indicate coverage, not truth.4 top sources shown
Overview
The Coruna exploit kit, initially linked to Russian state actors, is now being used in wider criminal activities. It targets iPhones running iOS 13.0 to 17.2.1, employing 23 exploits. Kaspersky has dismissed claims of NSA connections to this exploit kit.
Score total
1.41
Momentum 24h
4
Posts
4
Origins
4
Source types
1
Duplicate ratio
0%
Why it matters
- The Coruna exploit kit represents a significant threat to iOS security.
- Its use in criminal campaigns highlights the evolving landscape of cyber threats.
- Dismissals of its connections to state actors raise questions about its origins and implications.
LLM analysis
Topic mix: lowPromo risk: lowSource quality: high
Recurring claims
- Coruna exploit kit is being used in broader criminal campaigns.
- Coruna exploit kit targets iOS versions 13.0 to 17.2.1 with 23 exploits.
- Kaspersky dismisses claims of NSA connection to Coruna exploit kit.
How sources frame it
- Kaspersky: refuting
All evidence
All evidence
Nation-State iOS Exploit Kit ‘Coruna’ Found Powering Global Attacks
SecurityWeek · securityweek.com · 2026-03-05 04:04 UTC
Coruna exploit kit: Suspected government hacking tools surface in cybercriminal hands
SC Media · scworld.com · 2026-03-04 15:53 UTC
Kaspersky dismisses claims Coruna iPhone exploit kit is connected to NSA-linked operation
theregister_security · go.theregister.com · 2026-03-04 14:18 UTC
Coruna iOS Exploit Kit Uses 23 Exploits Across Five Chains Targeting iOS 13–17.2.1
The Hacker News · thehackernews.com · 2026-03-04 13:28 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 4Origin domains: 4Duplicates: -
Showing 4 / 0
Top publishers (this list)
- SecurityWeek (1)
- SC Media (1)
- theregister_security (1)
- The Hacker News (1)
Top origin domains (this list)
- securityweek.com (1)
- scworld.com (1)
- go.theregister.com (1)
- thehackernews.com (1)