A suite of government hacking tools targeting iPhones is now being used by cybercriminals | TechCrunch

"Google said the hacking tools are powerful as they can bypass an iPhone's defenses simply through visiting a malicious website containing the exploit code - such as being sent a malicious link - in what is known as a "watering hole" attack. According to Google, the Coruna kit can hack into an iPhone five separate ways by relying on and chaining together 23 separate vulnerabilities."

"It's unclear how the tools leaked or proliferated, but Google security researchers warned of an emerging market for "second hand" exploits, which are sold to hackers motivated by money to extract more value out of the exploit. The discovery also shows how exploits and back doors designed to be used by governments can leak and ultimately be abused by cybercriminals or other non-state actors."

""The more widespread the use, the more certain a leak will occur," said iVerify. "While iVerify has some evidence that this tool is a leaked US government framework, that shouldn't overshadow the knowledge that these tools will find their way into the wild and will be used unscrupulously by bad actors.""

Security researchers discovered Coruna, a sophisticated exploit kit targeting older iPhones, originally used by a government surveillance vendor. Google identified it in February 2025 attempting to deploy spyware, then found it used by Russian espionage groups targeting Ukrainians and Chinese financially-motivated hackers. The toolkit exploits 23 vulnerabilities enabling five separate attack vectors through watering hole attacks requiring only a malicious link. iVerify linked Coruna to U.S. government tools based on technical similarities. The leak illustrates an emerging market for second-hand exploits sold to cybercriminals, highlighting how government-designed hacking tools inevitably leak and get weaponized by non-state actors for criminal purposes.

Read at TechCrunch