{"id":"coruna-iphone-spyware-crypto-theft-mar-2026","category":"patch","status":"closed","title":"Coruna iPhone exploit kit used for surveillance and cryptocurrency theft","tldr":"Coruna used malicious websites to compromise older iPhones for spying and cryptocurrency theft. Apple has released fixes, including iOS/iPadOS 15.8.7 and 16.7.15 for older devices. Install the latest update your device offers.","summary":"Google disclosed Coruna on 3 March 2026 after tracking its use during 2025 by surveillance, suspected Russian espionage and financially motivated operators. Its 23 exploits formed five attack chains targeting iPhones running iOS 13.0–17.2.1. Malicious websites could compromise vulnerable phones; financial-theft payloads searched for wallet recovery phrases and banking information. iVerify independently reported cryptocurrency theft and collection of photographs and emails. Apple had already fixed vulnerabilities in newer software, then extended Coruna protection to older devices through iOS/iPadOS 15.8.7 and 16.7.15 on 11 March. Apple subsequently confirmed that fully updated devices were protected. One version discrepancy remains: Google maps CVE-2024-23296 to iOS 17.5, while Apple lists its fix in 17.4; the versions below follow Apple. The reviewed sources do not establish total victims, money stolen or recovered, or that all campaigns have ended.","action":"Open Settings > General > Software Update on each family iPhone and iPad and install the latest version offered; older devices need at least iOS/iPadOS 15.8.7 or 16.7.15 on those branches. If you suspect compromise, ask your security adviser to investigate and help reset affected account passwords from a trusted device.","product":"Apple iPhone and iPad (iOS and iPadOS)","audience":"both","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2020-27932","CVE-2020-27950","CVE-2021-30952","CVE-2022-48503","CVE-2023-32409","CVE-2023-32434","CVE-2023-38606","CVE-2023-41974","CVE-2023-43000","CVE-2023-43010","CVE-2024-23222","CVE-2024-23225","CVE-2024-23296"],"tags":["apple","iphone","ios","ipados","spyware","crypto","actively-exploited"],"affected":["Older iOS and iPadOS releases; Apple says devices on iOS 13 or 14 must upgrade to receive protection.","iOS and iPadOS 15 before 15.8.7 on iPhone 6s, iPhone 7, iPhone SE (1st generation), iPad Air 2, iPad mini (4th generation) and iPod touch (7th generation).","iOS and iPadOS 16 before 16.7.15 on iPhone 8, iPhone 8 Plus, iPhone X, iPad (5th generation), iPad Pro 9.7-inch and iPad Pro 12.9-inch (1st generation).","iOS and iPadOS 17 before 17.4 contain one or more of the listed vulnerabilities; Google's observed complete attack chains targeted iOS through 17.2.1."],"fixed":["iOS 15.8.7 and iPadOS 15.8.7: Coruna backports for devices limited to version 15.","iOS 16.7.15 and iPadOS 16.7.15: Coruna backport for devices limited to version 16.","iOS 17.4 and iPadOS 17.4: Apple's fixes for the last two listed vulnerabilities, CVE-2024-23225 and CVE-2024-23296; earlier updates fixed the other listed CVEs."],"matches":[{"platform":"ios","app":"iOS 15","bundle":"","fixed":"15.8.7"},{"platform":"ios","app":"iOS 16","bundle":"","fixed":"16.7.15"},{"platform":"ios","app":"iOS 17","bundle":"","fixed":"17.4"},{"platform":"ipados","app":"iPadOS 15","bundle":"","fixed":"15.8.7"},{"platform":"ipados","app":"iPadOS 16","bundle":"","fixed":"16.7.15"},{"platform":"ipados","app":"iPadOS 17","bundle":"","fixed":"17.4"}],"sources":[{"kind":"advisory","title":"About the security content of iOS 15.8.7 and iPadOS 15.8.7","url":"https://support.apple.com/en-mk/126632","by":"Apple","date":"2026-03-11"},{"kind":"advisory","title":"About the security content of iOS 16.7.15 and iPadOS 16.7.15","url":"https://support.apple.com/en-us/126646","by":"Apple","date":"2026-03-11"},{"kind":"advisory","title":"Update iOS to protect your iPhone from web attacks","url":"https://support.apple.com/en-mk/126776","by":"Apple","date":"2026-04-14"},{"kind":"research","title":"Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit","url":"https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit","by":"Google Threat Intelligence Group","date":"2026-03-03"},{"kind":"research","title":"iVerify Details First Known Mass iOS Attack","url":"https://www.iverify.com/press-releases/first-known-mass-ios-attack","by":"iVerify","date":"2026-03-03"},{"kind":"news","title":"Coruna iOS Exploit Kit Uses 23 Exploits Across Five Chains Targeting iOS 13–17.2.1","url":"https://thehackernews.com/2026/03/coruna-ios-exploit-kit-uses-23-exploits.html","by":"The Hacker News","date":"2026-03-03"},{"kind":"advisory","title":"About the security content of iOS 17.4 and iPadOS 17.4","url":"https://support.apple.com/en-gb/HT214081","by":"Apple","date":"2024-03-05"},{"kind":"advisory","title":"About the security content of iOS 14.2 and iPadOS 14.2","url":"https://support.apple.com/en-ie/103121","by":"Apple","date":"2020-11-05"},{"kind":"advisory","title":"About the security content of Safari 15.2","url":"https://support.apple.com/en-us/103170","by":"Apple","date":"2021-12-14"},{"kind":"advisory","title":"About the security content of Safari 15.6","url":"https://support.apple.com/en-ca/102893","by":"Apple","date":"2022-07-20"},{"kind":"advisory","title":"About the security content of Safari 16.5","url":"https://support.apple.com/en-mo/102735","by":"Apple","date":"2023-05-18"},{"kind":"advisory","title":"About the security content of iOS 16.5.1 and iPadOS 16.5.1","url":"https://support.apple.com/en-us/103837","by":"Apple","date":"2023-06-21"},{"kind":"advisory","title":"About the security content of iOS 16.6 and iPadOS 16.6","url":"https://support.apple.com/en-ca/120338","by":"Apple","date":"2023-07-24"}],"started":"2026-03-03","closed":"2026-04-14","created":"2026-11-03T20:25:13.593Z","updated":"2026-11-03T20:25:13.593Z","cve_notes":[{"cve":"CVE-2020-27932","name":"Type confusion in Apple's kernel","what":"A type confusion flaw in Apple's operating-system kernel could let a malicious app run code with the kernel's powerful privileges.","severity":"unknown","cvss":0},{"cve":"CVE-2020-27950","name":"Kernel memory disclosure in Apple devices","what":"A memory initialisation flaw in Apple's kernel could let a malicious app read kernel memory.","severity":"unknown","cvss":0},{"cve":"CVE-2021-30952","name":"Integer overflow in Apple WebKit","what":"An integer overflow in WebKit, Apple's web-content engine, could let a malicious webpage run an attacker's code.","severity":"unknown","cvss":0},{"cve":"CVE-2022-48503","name":"Code execution in Apple's JavaScriptCore","what":"A flaw in JavaScriptCore, which runs website scripts, could allow web content to execute an attacker's code.","severity":"unknown","cvss":0},{"cve":"CVE-2023-32409","name":"WebKit web-content sandbox escape","what":"A bounds-checking flaw in WebKit could let a remote attacker escape the isolation intended to contain web content.","severity":"unknown","cvss":0},{"cve":"CVE-2023-32434","name":"Integer overflow in Apple's kernel","what":"An integer overflow in Apple's kernel could let an app run code with kernel privileges.","severity":"unknown","cvss":0},{"cve":"CVE-2023-38606","name":"Sensitive kernel-state modification in Apple devices","what":"A state-management flaw in Apple's kernel could let an app change sensitive kernel state.","severity":"unknown","cvss":0},{"cve":"CVE-2023-41974","name":"Use-after-free in the iOS and iPadOS kernel","what":"A use-after-free flaw in the iOS and iPadOS kernel could let an app run code with kernel privileges.","severity":"unknown","cvss":0},{"cve":"CVE-2023-43000","name":"Use-after-free in Apple WebKit","what":"A use-after-free flaw in WebKit could let malicious web content corrupt memory.","severity":"unknown","cvss":0},{"cve":"CVE-2023-43010","name":"Memory corruption in Apple WebKit","what":"A memory-handling flaw in WebKit could let malicious web content corrupt memory.","severity":"unknown","cvss":0},{"cve":"CVE-2024-23222","name":"Type confusion in Apple WebKit","what":"A type confusion flaw in WebKit could let malicious web content run an attacker's code.","severity":"unknown","cvss":0},{"cve":"CVE-2024-23225","name":"Kernel memory-protection bypass in Apple devices","what":"A memory corruption flaw in Apple's kernel could let an attacker who already has kernel read and write access bypass kernel memory protections.","severity":"unknown","cvss":0},{"cve":"CVE-2024-23296","name":"RTKit kernel memory-protection bypass","what":"A memory corruption flaw in Apple's RTKit component could let an attacker who already has kernel read and write access bypass kernel memory protections.","severity":"unknown","cvss":0}],"timeline":[{"at":"2026-04-14","added":"2026-11-03T20:12:05.486Z","kind":"vendor-revised","text":"Apple's updated guidance said fully updated iOS 15 through iOS 26 devices were protected against the reported web attacks. Devices still running iOS 13 or 14 needed to upgrade to receive protection.","url":"https://support.apple.com/en-mk/126776","by":"Apple","patch":null},{"at":"2026-03-11","added":"2026-11-03T20:12:05.486Z","kind":"new-fix","text":"Apple also released iOS and iPadOS 16.7.15 for older devices including iPhone 8 and iPhone X. It brought across the Coruna-related CVE-2023-43010 fix previously released in iOS 17.2.","url":"https://support.apple.com/en-us/126646","by":"Apple","patch":"patched"},{"at":"2026-03-11","added":"2026-11-03T20:12:05.486Z","kind":"new-fix","text":"Apple released iOS and iPadOS 15.8.7, bringing four Coruna-related fixes to older devices, including iPhone 6s, iPhone 7 and the first-generation iPhone SE.","url":"https://support.apple.com/en-mk/126632","by":"Apple","patch":"partial"},{"at":"2026-03-05","added":"2026-11-03T20:12:05.486Z","kind":"cisa-added","text":"CISA added CVE-2021-30952, CVE-2023-41974 and CVE-2023-43000 to its Known Exploited Vulnerabilities catalogue, with a 26 March remediation deadline for US federal civilian agencies.","url":"https://thehackernews.com/2026/03/coruna-ios-exploit-kit-uses-23-exploits.html","by":"The Hacker News","patch":null},{"at":"2026-03-03","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"iVerify published its independent investigation, calling the financial-theft malware CryptoWaters. It reported cryptocurrency theft and collection of sensitive information, including photographs and emails.","url":"https://www.iverify.com/press-releases/first-known-mass-ios-attack","by":"iVerify","patch":null},{"at":"2026-03-03","added":"2026-11-03T20:12:05.486Z","kind":"disclosed","text":"Google disclosed Coruna: 23 exploits forming five complete attack chains. It traced use from a surveillance-company customer in February 2025 to suspected Russian espionage targeting Ukrainians that summer, then financially motivated attacks through Chinese-language websites late in 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit","by":"Google Threat Intelligence Group","patch":"partial"}],"url":"https://hard.fyi/live/coruna-iphone-spyware-crypto-theft-mar-2026/","json":"https://hard.fyi/api/live?id=coruna-iphone-spyware-crypto-theft-mar-2026"}