Have you ever wondered what happens when a top-secret digital weapon falls into the wrong hands? Imagine simply visiting a normal website on your iPhone, and without you tapping or downloading a single thing, your device is silently compromised. It sounds like a Hollywood spy thriller, but this is the terrifying reality of a newly uncovered threat. According to recent findings from Google’s Threat Intelligence Group and mobile security firm iVerify, a highly sophisticated iPhone hacking toolkit has escaped its original creators and is now wreaking havoc across the globe.
What Is the ‘Coruna’ iOS Exploit Kit?
Security researchers have dubbed this malware toolkit “Coruna.” It is essentially a digital master key for older Apple devices, packing 23 distinct vulnerabilities targeting iPhones running iOS 13 through 17.2.1. For years, we have been taught that as long as we don’t click suspicious links or download shady apps, our devices are relatively safe. Coruna throws that conventional wisdom out the window.
The scariest part of this toolkit is that it relies on a “zero-click” exploit. This means the malware can be silently installed on a victim’s iPhone simply by them visiting a compromised website. No user interaction, no pop-ups, and no warnings are required. Once the page loads, the phone is infected.
![Illustration related to Coruna iOS Zero-Click Exploit: How It Leaked [Explained]](https://bytewire.press/wp-content/uploads/bytewire-images/2026/03/leaked-us-cyber-weapon-coruna-iphone-crypto-scam-6e8cb0e60f.webp)
How Did U.S. Military Tech Reach Russian Spies?
So, who builds a tool this powerful? According to reports, the original developer of these government-grade hacking tools was likely U.S. military defense contractor L3Harris. The offensive cybersecurity market operates in the shadows, creating digital lockpicks meant for national security and intelligence gathering. But in a massive custody failure, the Coruna toolkit leaked.
The proliferation of this toolkit highlights a systemic risk in cyber warfare: advanced weapons developed for Western intelligence can, and do, leak to foreign adversaries. The toolkit shares core components with “Operation Triangulation,” a 2023 mobile malware campaign that Russian officials previously blamed on the NSA. Recently, a suspected Russian espionage group known as UNC6353 was caught utilizing the Coruna toolkit against Ukrainian targets. This represents a rare, highly documented case of a U.S. cyber weapon escaping controlled channels and being turned against strategic allies.
![Diagram related to Coruna iOS Zero-Click Exploit: How It Leaked [Explained]](https://bytewire.press/wp-content/uploads/bytewire-images/2026/03/leaked-us-cyber-weapon-coruna-iphone-crypto-scam-0a1d5a0a2c.webp)
Get our analysis in your inbox
No spam. Unsubscribe anytime.
