{"id":6085,"date":"2026-08-20T15:04:39","date_gmt":"2026-08-20T15:04:39","guid":{"rendered":"https:\/\/adex.com\/blog\/?p=6085"},"modified":"2026-08-21T07:22:11","modified_gmt":"2026-08-21T07:22:11","slug":"coruna-ios-exploit-kit","status":"publish","type":"post","link":"https:\/\/adex.com\/blog\/coruna-ios-exploit-kit\/","title":{"rendered":"The Coruna iOS Exploit Kit: How Zero-Click Attacks Mirror Ad Fraud Tactics"},"content":{"rendered":"\n

On March 3, 2026, Google Threat Intelligence Group published its analysis of Coruna, an iOS exploit kit.<\/a> This kit was a full <\/a>framework with five complete exploit chains and 23 individual exploits, covering every iOS version from 13.0 to 17.2.1. The delivery was zero-click: a user opened a web page in Safari, and the attack began before anything even appeared on screen, but only if the device matched.<\/p>\n\n\n\n

Yes, here is the trick that helped Coruna stay out of sight for years: before it delivers anything, it fingerprints the visitor and decides whether that visitor is worth exploiting, and visitors who fail the check get something harmless instead. That is the same filtering logic that ad cloaking uses to separate moderation systems from real users, running with the goal inverted.<\/p>\n\n\n\n

Inside the Coruna Exploit Kit<\/h2>\n\n\n\n
Coruna works like a construction set, or a modular framework, as GTIG describes it. The set contains separate pieces that share a common set of utilities, and the kit’s own loaders hold them together. Each iOS band gets a matched exploit and bypass: one bypass for iOS 13 through 14.x, another for 15 through 16.2, and three more covering the 16.3 to 17.2.1 range.<\/p>\n\n\n\n\n\n
\n