A series of government hacking tools targeting iPhones are being used by cybercriminals

Security researchers have identified a set of powerful hacking tools that can compromise iPhones running outdated software, and they say the tools have fallen into the hands of cybercriminals from government customers.

Google announced Tuesday that it first identified an exploit kit called Coruna in February 2025 when the surveillance vendor tried to use spyware to hack someone’s phone on behalf of a government customer. Months later, the same exploit kit was found to be targeting users in Ukraine in a large-scale campaign by a Russian spy group, and later was found to be used by financially motivated hackers in China.

It’s unclear how the tool was leaked or spread, but security researchers at Google are warning of an emerging market of “second-hand” exploits that are sold to financially motivated hackers to extract more value from the exploits.

The discovery also shows how exploits and backdoors designed for use by governments can be leaked and ultimately exploited by cybercriminals and other non-state actors. Mobile security company iVerify said in a blog post that it acquired the hacking tool, reverse engineered it, and linked the Coruna exploit kit to the U.S. government based on its similarities to hacking tools previously attributed to the United States.

“The more widespread use becomes, the more likely a breach will occur,” iVerify said. “iVerify has some evidence that this tool is a leaked U.S. government framework, but that does not override the knowledge that these tools are out there and used unscrupulously by bad actors.”

Google said these hacking tools are powerful because they can bypass the iPhone’s defenses simply by visiting a malicious website containing exploit code (for example, a malicious link is sent) in a so-called “watering hole” attack. According to Google, the Coruna kit can hack iPhones in five separate ways by leveraging 23 separate vulnerabilities in its digital arsenal and chaining them together. Affected devices span iPhone models running iOS 13 through 17.2.1 released in December 2023.

According to Wired, which first reported the news, the Coruna kit contains components previously used in a hacking campaign called Operation Triangulation. In 2023, Russian cybersecurity company Kaspersky claimed that the U.S. government attempted to hack into several iPhones belonging to its employees.

Leaks of hacking tools are rare, but not unheard of. In 2017, the U.S. National Security Agency discovered that a tool it had developed to hack Windows computers was being stolen around the world. The Windows back door, known as EternalBlue, was later exposed and used by cybercriminals in subsequent attacks, including North Korea’s 2017 WannaCry ransomware attack.

TechCrunch also recently reported on the case of Peter Williams, former head of US defense contractor L3 Harris Trencinto. He was sentenced to more than seven years in prison after pleading guilty to stealing eight exploits and selling them to brokers known to work with the Russian government.

Prosecutors said Williams sold exploits that could hack “millions of computers and devices” around the world. At least one exploit was sold to a Korean broker. It is unclear if this exploit was disclosed to the software manufacturer or if it was patched.