Cybersecurity experts have uncovered sophisticated spyware named 'Coruna' that targets older iPhones running iOS versions between 2019 and late 2023. The spyware can steal sensitive data by exploiting vulnerabilities in the Safari browser when users click on malicious links.
Key Takeaways
Cybersecurity experts have uncovered sophisticated spyware named 'Coruna' that targets older iPhones running iOS versions between 2019 and late 2023. The spyware can steal sensitive data by exploiting vulnerabilities in the Safari browser when users click on malicious links. Researchers believe it may have originated as a U.S. government surveillance tool before leaking to cybercriminal groups.
- Spyware 'Coruna' targets iPhones with iOS versions from 2019 to late 2023
- Exploits vulnerabilities in Safari browser through malicious links
- May have originated as a U.S. government surveillance tool, now used by cybercriminals
- Can steal text messages, photos, notes, and financial data
- Users urged to update their iPhones immediately or enable Lockdown Mode
The spyware, first identified by researchers at Google's Threat Intelligence Group (GTIG), has been tracked since February 2025. It contains over 20 vulnerabilities that allow hackers to bypass built-in security protections and gain access to sensitive information such as photos, notes, and financial data.
Researchers believe the spyware may have originated as a U.S. government surveillance tool before leaking into the hands of cybercriminal groups. It has been used in various attacks, including by Russian espionage groups targeting Ukrainian websites and Chinese hackers deploying it through fake cryptocurrency platforms.
The attack can be triggered when users click on a malicious link, which then secretly checks device details and launches hidden code to take control of the phone. Once inside, the spyware installs additional software that allows hackers to collect sensitive information and expand their access.
Security experts urge iPhone users to update their devices immediately or enable Apple's Lockdown Mode to protect themselves from this threat. The latest versions of iOS include patches for the vulnerabilities used in the attack.
How this summary was created
This summary synthesizes reporting from 3 independent publishers using AI. All sources are cited and linked below. NewsBalance is a news aggregator and media literacy tool, not a news publisher. AI-generated content may contain errors or inaccuracies — always verify important information with the original sources.