Cybercriminals repurpose gov't iPhone hacks - AI News Today Recency

# Cybercriminals Repurpose Gov't iPhone Hacks

In a alarming escalation of cyber threats, sophisticated iPhone hacking tools originally developed by the US government have leaked and are now being repurposed by cybercriminals and foreign spies, infecting tens of thousands of devices worldwide. Dubbed "Coruna" by security researchers, this exploit kit—linked to advanced zero-day vulnerabilities in iOS—has transitioned from state surveillance to mass-scale attacks targeting cryptocurrency wallets and personal data.[1][2][4]

The Rise of Coruna: From US Toolkit to Global Threat

Security firms like iVerify and Google's Threat Intelligence Group have uncovered Coruna, a professionally developed iPhone exploit kit bearing hallmarks of US government origins, including native-level English documentation and extreme technical sophistication.[1][2][4] First detected in late February with fragments appearing as early as last year, the toolkit exploits over 20 vulnerabilities across iOS versions 13 to 17.2.1, enabling silent infections via malicious iMessages, compromised websites, or proximity attacks without user interaction.[1][2]

Once deployed, Coruna provides attackers full device control, extracting messages, photos, location data, and activating cameras or microphones covertly while surviving reboots and updates through firmware flaws.[1][4] Researchers describe it as the "first known mass iOS attack," impacting at least 42,000 devices across continents, echoing the 2017 Shadow Brokers NSA leak that fueled global ransomware like WannaCry.[2][4]

Cybercriminals and Spies Exploit Leaked Government Tech

What began as targeted surveillance—potentially tied to US intelligence and even Russia's alleged "Operation Triangulation" linked to the NSA—has proliferated to adversaries.[2][4] Russian intelligence reportedly used Coruna against Ukrainian targets, while a Chinese cybercrime group repurposed it to steal cryptocurrency and financial credentials from victims.[2][4]

Financially motivated hackers have integrated the tools into scam infrastructure, marking a shift from espionage to broad criminal use, with even "lowly cybercriminals" abusing zero-days against Apple devices.[4][6] This leak underscores the risks of government hacking tools escaping control, now wielded by non-state actors for profit.[1][6]

Apple's Response and Ongoing Risks

Apple has patched many underlying flaws, including recent zero-days like CVE-2026-20700 reported by Google's Threat Analysis Group, which CISA added to its Known Exploited Vulnerabilities catalog, mandating federal remediation by March 5, 2026.[5] Despite patches for newer iOS versions, older devices remain vulnerable, and researchers warn of potential expansion as more details emerge.[2][4][5]

Amid these threats, Apple achieved a milestone with iPhone and iPad approved for NATO classified information handling under iOS 26, highlighting built-in security strengths even as exploits challenge the ecosystem.[7][8][9]

Implications for iPhone Users and Global Security

The Coruna saga raises alarms about supply chain risks in cyber tools, with iVerify calling it an "EternalBlue moment" for iOS.[4] Victims span governments, political campaigns, media, and civilians, including potential US and EU targets linked to Chinese hacking patterns.[3] Users on legacy iOS should update immediately, while the incident fuels debates on government exploit stockpiling and proliferation to criminals.[1][3]

Frequently Asked Questions

What is the Coruna iPhone hacking toolkit? **Coruna** is an advanced exploit kit likely developed by the US government, featuring multiple zero-day vulnerabilities to silently compromise iPhones via iMessages, websites, or proximity, granting full access to data and hardware.[1][2][4]

How did cybercriminals obtain these government hacks? The toolkit leaked from controlled channels, first used in state operations like Russian attacks on Ukraine, then adopted by Chinese cybercriminals for financial theft, similar to past NSA exploit dumps.[2][4]

Are current iPhones safe from Coruna exploits? Apple has patched affected vulnerabilities in newer iOS versions, but devices on iOS 13-17.2.1 remain at risk; users should update promptly, especially legacy systems.[2][5]

Who were the main victims of these repurposed hacks? Infections hit tens of thousands worldwide, including Ukrainian targets, Chinese cryptocurrency users, and potential US/EU government affiliates, media, and AI firms.[1][2][3][4]

What makes Coruna different from typical iPhone attacks? It's the first "mass iOS attack" with state-level sophistication, persisting through updates and using 20+ zero-days, now scaled by criminals beyond espionage.[2][4]

Has Apple or the US government responded officially? Apple issued patches, including for CVE-2026-20700; CISA mandated fixes for federal agencies. The NSA declined comment on origins.[4][5]