Security researchers have identified a suite of powerful hacking tools capable of compromising iPhones running older software that they say has passed from a government customer into the hands of cybercriminals.
Google said Tuesday that it first identified the exploit kit, dubbed Coruna, in February 2025 during a surveillance vendor’s attempt to hack into someone’s phone with spyware on behalf of a government customer. It found the same exploit kit months later targeting Ukrainian users in a broad-scale campaign by a Russian espionage group, and then later found it used by a financially motivated hacker in China.