A suite of government hacking tools targeting iPhones is now being used by cybercriminals

Security experts have uncovered a set of sophisticated hacking tools designed to breach older iPhone software, which have now fallen into the hands of cybercriminals. Google announced on Tuesday that it first detected this exploit kit, known as Coruna, in February 2025. The tools were originally being used by a surveillance vendor attempting to infiltrate a phone on behalf of a government entity. Months later, Google found the same exploit kit being utilized against Ukrainian users as part of a large-scale operation by a Russian espionage group. The tools were subsequently linked to financial cybercriminals in China. The exact circumstances surrounding the tools' leak remain unclear, but Google researchers have highlighted the emergence of a market for “secondhand” exploits. These tools are sold to hackers seeking to maximize their value for profit. This finding underscores a troubling trend: exploits and backdoors developed for governmental use can leak and be misused by cybercriminals and non-state actors. Mobile security firm iVerify analyzed and reverse-engineered the hacking tools, asserting in a blog post that the Coruna exploit kit shows similarities to tools previously attributed to the U.S. government, suggesting a connection. “The more widespread the use, the higher the chance of a leak,” stated iVerify. “While we have some evidence linking this tool to the U.S. government, it’s crucial to recognize that these tools will inevitably end up in the wrong hands, used unscrupulously by malicious actors.” According to Google, these hacking tools are particularly potent, able to bypass defenses on iPhones merely by accessing a malicious website that contains the exploit code—a method referred to as a “watering hole” attack. The Coruna kit can infiltrate an iPhone in five distinct ways by exploiting and chaining together 23 vulnerabilities. Affected devices include iPhone models operating on iOS versions ranging from 13 to 17.2.1, the latter of which was released in December 2023. Wired, which first broke the story, noted that the Coruna kit includes components previously associated with a hacking campaign known as Operation Triangulation. In a 2023 report, the Russian cybersecurity firm Kaspersky revealed attempts by the U.S. government to hack iPhones belonging to its employees. While the leakage of hacking tools is not common, it has occurred before. In 2017, the U.S. National Security Agency found that its tools for hacking Windows computers had been stolen. One of those exploits, EternalBlue, was later released and utilized by cybercriminals in attacks, including the notorious 2017 WannaCry ransomware incident linked to North Korea. Recently, TechCrunch reported on Peter Williams, the former head of the U.S. defense contractor L3Harris Trenchant, who received a prison sentence of over seven years for stealing and selling eight exploits to a broker with connections to the Russian government. These exploits had the capability to breach millions of computers and devices globally, though it remains uncertain whether they were ever disclosed to the software developers or patched.