Coruna Malware — Analysis, Campaigns & Threat Activity

Threat entity extracted from intelligence sources

Frequency
44
occurrences
First Seen
March 3, 2026
Last Seen
July 12, 2026

Coruna is a malware family tracked across 10 threat clusters and 44 intelligence report mentions on ThreatCluster. First observed March 3, 2026; most recent activity July 12, 2026.

Related Threat Clusters

  • DarkSword iOS Exploit Chain Targets Mobile Devices Globally

    The Google Threat Intelligence Group has identified DarkSword, a full-chain iOS exploit affecting versions 18.4 to 18.7. This exploit leverages multiple zero-day vulnerabilities, including CVE-2025-31277 and…

    2 articles · Updated July 11, 2026
  • iOS Update Addresses Critical Security Flaw CVE-2026-28950

    On April 22, 2026, Apple published CVE-2026-28950, a critical security flaw that allowed deleted notifications to be retrieved, posing a significant privacy risk. The issue affects all iPhones starting from the iPhone…

    3 articles · Updated May 2, 2026
  • Coruna Spyware Exploited by State Actors in Global Campaigns

    A mass cyber-espionage campaign targeting iPhone users in Ukraine and China has emerged, utilizing the Coruna exploit kit, developed by U.S. military contractor L3Harris' Trenchant division. The toolkit, comprising 23…

    4 articles · Updated March 12, 2026
  • CISA Includes Coruna Exploit Kit iOS Vulnerabilities in KEV List

    CISA has added 23 vulnerabilities exploited by the Coruna exploit kit targeting iOS versions 13 to 17.2.1 to its Known Exploited Vulnerabilities (KEV) list. The exploit kit is associated with nation-state actors,…

    2 articles · Updated March 6, 2026
  • Coruna Malware Targets iPhones to Steal Crypto Seed Phrases

    Google has issued an urgent warning about a new malware strain named Coruna that specifically targets iPhone users worldwide to steal cryptocurrency seed phrases. This malware poses a significant risk to individuals…

    4 articles · Updated March 5, 2026
  • Supply Chain Attack on art-template npm Package Delivers iOS Exploit

    The art-template npm package, a popular JavaScript templating library, was compromised to deliver a sophisticated iOS exploit targeting Safari users. Discovered on May 20, 2026, the attack involved a watering-hole…

    4 articles · Updated May 22, 2026
  • Coruna Exploit Kit Linked to Operation Triangulation Framework

    Kaspersky's Global Research and Analysis Team has identified the Coruna exploit kit as an updated version of the Operation Triangulation framework used in a 2023 cyber-espionage campaign. The analysis revealed that one…

    3 articles · Updated March 26, 2026
  • AI-Driven Exploit Bypasses Apple's M5 Security in Days

    Researchers from Calif, a Palo Alto-based cybersecurity startup, successfully exploited Apple's Memory Integrity Enforcement (MIE) on the M5 chip within a week using Anthropic's AI model, Claude Mythos. The exploit…

    28 articles · Updated May 14, 2026
  • 2026 Smartphone Security Threats: Zero-Click Exploits and Banking Trojans Rise

    In May 2026, a critical Android vulnerability (CVE-2026-0073) was disclosed, allowing remote device takeover without user interaction. This flaw, linked to the Android Debug Bridge, affects devices with ADB enabled,…

    2 articles · Updated May 23, 2026
  • Coruna iOS Exploit Kit Targets Multiple Threat Actors

    The Coruna iOS exploit kit has emerged, targeting Apple iPhone models running iOS 13.0 to 17.2.1. It includes five exploit chains and 23 exploits, with advanced techniques that are non-public. Various threat actors,…

    372 articles · Updated March 3, 2026

Recent Intelligence Reports

  • Darksword — www.lookout.com · July 12, 2026
  • Compromised art-template npm Package Delivers Coruna-Like iOS Exploit — Technadu · May 21, 2026
  • How Smartphones Get Hacked: The 2026 Threat Landscape You Need to Understand — Vocal.Media · May 20, 2026
  • Calif team details how Anthropic Mythos helped build a working macOS exploit in five days — 9To5Mac · May 14, 2026
  • iOS 26 Updates Balance New Features With Urgent Security Needs — Azat.Tv · May 2, 2026
  • Apple extends security updates to older iPhones at risk of hacking — Digitaltrends · April 2, 2026
  • Apple confirms an iOS 18 patch for the DarkSword exploit, even for users who skipped ... — Tweaktown · April 1, 2026
  • Apple Offers iOS 18.7.7 Security Update as Alternative to iOS 26.4 Upgrade — Tidbits · April 1, 2026

CVSS v3.1 Breakdown