Google has found an iPhone attack toolkit called Coruna. Signs have emerged that Coruna, believed to have been developed for government customers, has flowed into cybercrime groups, raising expectations of wider fallout.

Google has confirmed that an iPhone hacking tool called Coruna has been leaked and used in multiple cyberattacks, TechCrunch reported on Tuesday.

Google first discovered Coruna in February 2025 after detecting an attempt by a surveillance company to hack iPhones for a government customer. Coruna was later used in a large attack by a Russian espionage group targeting Ukrainian users, and financially motivated Chinese hackers were also confirmed to have used it.

Coruna uses a watering hole attack method that can infect an iPhone simply by having a user visit a malicious website. Google said the tool can hack iPhones in 5 ways by combining 23 vulnerabilities, affecting devices running iOS 13 to 17.2.1.

Mobile security firm iVerify said Coruna is similar to hacking tools previously used by the U.S. government. It was also suggested that the tool could be linked to Operation Triangulation, in which the U.S. government tried to hack employees of Russian security firm Kaspersky in 2023.