NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

Coruna iPhone exploit kit used for surveillance and cryptocurrency theft

Coruna used malicious websites to compromise older iPhones for spying and cryptocurrency theft. Apple has released fixes, including iOS/iPadOS 15.8.7 and 16.7.15 for older devices. Install the latest update your device offers.

What to do

Open Settings > General > Software Update on each family iPhone and iPad and install the latest version offered; older devices need at least iOS/iPadOS 15.8.7 or 16.7.15 on those branches. If you suspect compromise, ask your security adviser to investigate and help reset affected account passwords from a trusted device.

Check your devices
  • iOS 15fixed in 15.8.7 and later
  • iOS 16fixed in 16.7.15 and later
  • iOS 17fixed in 17.4 and later
  • iPadOS 15fixed in 15.8.7 and later
  • iPadOS 16fixed in 16.7.15 and later
  • iPadOS 17fixed in 17.4 and later

What’s happening

Google disclosed Coruna on 3 March 2026 after tracking its use during 2025 by surveillance, suspected Russian espionage and financially motivated operators. Its 23 exploits formed five attack chains targeting iPhones running iOS 13.0–17.2.1. Malicious websites could compromise vulnerable phones; financial-theft payloads searched for wallet recovery phrases and banking information. iVerify independently reported cryptocurrency theft and collection of photographs and emails. Apple had already fixed vulnerabilities in newer software, then extended Coruna protection to older devices through iOS/iPadOS 15.8.7 and 16.7.15 on 11 March. Apple subsequently confirmed that fully updated devices were protected. One version discrepancy remains: Google maps CVE-2024-23296 to iOS 17.5, while Apple lists its fix in 17.4; the versions below follow Apple. The reviewed sources do not establish total victims, money stolen or recovered, or that all campaigns have ended.

What
Flaw
Affects
Apple iPhone and iPad (iOS and iPadOS)
Affected
Older iOS and iPadOS releases; Apple says devices on iOS 13 or 14 must upgrade to receive protection.
iOS and iPadOS 15 before 15.8.7 on iPhone 6s, iPhone 7, iPhone SE (1st generation), iPad Air 2, iPad mini (4th generation) and iPod touch (7th generation).
iOS and iPadOS 16 before 16.7.15 on iPhone 8, iPhone 8 Plus, iPhone X, iPad (5th generation), iPad Pro 9.7-inch and iPad Pro 12.9-inch (1st generation).
iOS and iPadOS 17 before 17.4 contain one or more of the listed vulnerabilities; Google's observed complete attack chains targeted iOS through 17.2.1.
Fixed in
iOS 15.8.7 and iPadOS 15.8.7: Coruna backports for devices limited to version 15.
iOS 16.7.15 and iPadOS 16.7.15: Coruna backport for devices limited to version 16.
iOS 17.4 and iPadOS 17.4: Apple's fixes for the last two listed vulnerabilities, CVE-2024-23225 and CVE-2024-23296; earlier updates fixed the other listed CVEs.
CVE
CVE-2020-27932, CVE-2020-27950, CVE-2021-30952, CVE-2022-48503, CVE-2023-32409, CVE-2023-32434, CVE-2023-38606, CVE-2023-41974, CVE-2023-43000, CVE-2023-43010, CVE-2024-23222, CVE-2024-23225, CVE-2024-23296
Since
3 Mar 2026
Closed
14 Apr 2026

Timeline

  1. Vendor revised

    Apple's updated guidance said fully updated iOS 15 through iOS 26 devices were protected against the reported web attacks. Devices still running iOS 13 or 14 needed to upgrade to receive protection.

  2. New fixFixed

    Apple also released iOS and iPadOS 16.7.15 for older devices including iPhone 8 and iPhone X. It brought across the Coruna-related CVE-2023-43010 fix previously released in iOS 17.2.

  3. New fixPartly fixed

    Apple released iOS and iPadOS 15.8.7, bringing four Coruna-related fixes to older devices, including iPhone 6s, iPhone 7 and the first-generation iPhone SE.

  4. CISA added

    CISA added CVE-2021-30952, CVE-2023-41974 and CVE-2023-43000 to its Known Exploited Vulnerabilities catalogue, with a 26 March remediation deadline for US federal civilian agencies.

  5. Update

    iVerify published its independent investigation, calling the financial-theft malware CryptoWaters. It reported cryptocurrency theft and collection of sensitive information, including photographs and emails.

  6. Made publicPartly fixed

    Google disclosed Coruna: 23 exploits forming five complete attack chains. It traced use from a surveillance-company customer in February 2025 to suspected Russian espionage targeting Ukrainians that summer, then financially motivated attacks through Chinese-language websites late in 2025.

Sources

  1. About the security content of iOS 15.8.7 and iPadOS 15.8.7Apple · 11 Mar 2026
  2. About the security content of iOS 16.7.15 and iPadOS 16.7.15Apple · 11 Mar 2026
  3. Update iOS to protect your iPhone from web attacksApple · 14 Apr 2026
  4. Coruna: The Mysterious Journey of a Powerful iOS Exploit KitGoogle Threat Intelligence Group · 3 Mar 2026
  5. iVerify Details First Known Mass iOS AttackiVerify · 3 Mar 2026
  6. Coruna iOS Exploit Kit Uses 23 Exploits Across Five Chains Targeting iOS 13–17.2.1The Hacker News · 3 Mar 2026
  7. About the security content of iOS 17.4 and iPadOS 17.4Apple · 5 Mar 2024
  8. About the security content of iOS 14.2 and iPadOS 14.2Apple · 5 Nov 2020
  9. About the security content of Safari 15.2Apple · 14 Dec 2021
  10. About the security content of Safari 15.6Apple · 20 July 2022
  11. About the security content of Safari 16.5Apple · 18 May 2023
  12. About the security content of iOS 16.5.1 and iPadOS 16.5.1Apple · 21 June 2023
  13. About the security content of iOS 16.6 and iPadOS 16.6Apple · 24 July 2023
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from March 2026 · JSON · RSS