Recent reports from Help Net Security indicate that a sophisticated iOS exploit kit dubbed “Coruna”has emerged, primarily used to facilitate large-scale financial crime. 

Key Characteristics

• Spy-Grade Capabilities: Coruna utilizes advanced exploitation techniques typically reserved for high-end state-sponsored surveillance, but it is being weaponized by cybercriminals for financial gain.
• Targeted Victims: The kit has been observed in the hands of various threat actors, including customers of surveillance firms and cyber espionage groups, suggesting a “leaked” or sold-as-a-service model.
• Operation Mechanism: It leverages complex redirection logic, such as OAuth redirection, to deliver malware to iOS devices, bypassing standard security measures to compromise sensitive financial data.

The discovery highlights a growing trend where professional-grade surveillance tools are trickling down to the broader criminal ecosystem, increasing the risk for everyday mobile users.