Coruna iOS exploit kit moved from spy tool to mass criminal campaign in under a year

Coruna is a sophisticated exploit kit (a package of tools that exploit security vulnerabilities) targeting iPhones that spread from a commercial surveillance vendor's customer to a Russian espionage group to Chinese cybercriminals within a year, revealing an active secondary market for zero-day exploits (previously unknown vulnerabilities). The kit contains 23 individual exploits affecting iPhones from iOS 13.0 through 17.2.1 and deploys Plasmagrid, malware designed to steal cryptocurrency by targeting 18 wallet applications and extracting credentials and seed phrases (backup codes for cryptocurrency accounts). The case demonstrates how high-end exploitation tools originally developed for targeted surveillance can be repurposed and redistributed for mass criminal campaigns.