{"id":2957,"date":"2026-04-09T15:07:52","date_gmt":"2026-04-09T13:07:52","guid":{"rendered":"https:\/\/neverhack.com\/b\/?p=2957"},"modified":"2026-04-09T15:07:52","modified_gmt":"2026-04-09T13:07:52","slug":"how-to-stop-the-coruna-exploit-kit-targeting-iphones-and-macs","status":"publish","type":"post","link":"https:\/\/neverhack.com\/b\/en\/blog\/how-to-stop-the-coruna-exploit-kit-targeting-iphones-and-macs\/","title":{"rendered":"How to\u202fstop the Coruna\u202fexploit\u202fkit\u202ftargeting iPhones and Macs\u00a0"},"content":{"rendered":"\n<p>New attacks, zero-click vulnerabilities, and unpatched devices. Here is what is happening to Apple devices and the essential rules for defending against potential intrusions on phones and computers.\u202f\u00a0<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-what-we-found-coruna-is-not-a-reason-for-panic-but-it-is-a-wake-up-call-nbsp\"><strong>What we found: Coruna is not a reason for panic, but it is a wake-up call<\/strong>\u202f&nbsp;<\/h2>\n\n\n\n<p>For users, the discovery of <strong>Coruna <\/strong>should not trigger\u202falarm, but rather serve as a clear reminder to stay aware and vigilant. These are highly targeted attacks, rarely indiscriminate, yet they confirm a fundamental principle: no device can be considered completely immune.\u202f\u00a0<\/p>\n\n\n\n<p>The Coruna exploit kit,\u202f<a href=\"https:\/\/cloud.google.com\/blog\/topics\/threat-intelligence\/coruna-powerful-ios-exploit-kit\" target=\"_blank\" rel=\"noreferrer noopener\">identified by Google&#8217;s Threat Intelligence Group (GTIG) in February 2025<\/a>,\u202fcontains\u202ffive full iOS exploit chains and a total of <strong>23 exploits targeting iPhones<\/strong> running iOS 13.0 through 17.2.1. Since its\u202finitial\u202fdiscovery, the toolkit has moved from targeted surveillance operations to broader campaigns, including watering hole attacks against Ukrainian targets and large-scale cryptocurrency theft through fake\u202ffinancial websites.\u202f\u00a0<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-keep-your-operating-system-updated-the-most-effective-defense-nbsp\"><strong>Keep your operating system updated: the most effective defense<\/strong>\u202f&nbsp;<\/h2>\n\n\n\n<p>In this context, the most effective defense\u202fremains\u202fthe simplest one: keeping your operating system up to date. Many exploits target outdated versions of iOS, and regularly installing security patches allows you to\u202ffix known vulnerabilities and significantly reduce your attack surface.\u202f&nbsp;<\/p>\n\n\n\n<p>Apple has confirmed that devices running the latest versions of iOS 15 through iOS 26 are already protected. For newer iOS versions (16.6 onward), patches addressing Coruna-related vulnerabilities were shipped as early as 2023 and 2024. On March 11, 2026, Apple extended protection to older devices that cannot run the latest iOS.\u202f&nbsp;<\/p>\n\n\n\n<p>Organizations managing large fleets of mobile devices should treat unpatched endpoints as a critical risk. A structured\u202f<a href=\"https:\/\/neverhack.com\/en\/offers\/offensive-security\" target=\"_blank\" rel=\"noreferrer noopener\">vulnerability assessment<\/a>\u202fprogram helps\u202fidentify\u202fwhich devices\u202fremain\u202fexposed and prioritize remediation before threats like Coruna can be exploited.\u202f&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-exercise-caution-while-browsing-links-and-compromised-websites-nbsp\"><strong>Exercise caution while\u202fbrowsing:\u202flinks and compromised websites<\/strong>\u202f&nbsp;<\/h2>\n\n\n\n<p>It is equally important to\u202fbe careful\u202fwhen navigating online. Suspicious links, especially those received via email or messages from unverified contacts, can serve as an attack vector. In some cases, vulnerabilities can be exploited simply by visiting compromised websites, without any direct interaction from the user. In cybersecurity terminology, these are known as &#8220;watering hole&#8221; attacks.\u202f&nbsp;<\/p>\n\n\n\n<p>For organizations, this type of threat reinforces the need for\u202f<a href=\"https:\/\/neverhack.com\/en\/offers\/soc-mssp\" target=\"_blank\" rel=\"noreferrer noopener\">continuous security monitoring<\/a>\u202fcapable of detecting anomalous network traffic and blocking connections to known malicious domains before they reach end-user devices.\u202f&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-lockdown-mode-advanced-protection-for-high-risk-users-nbsp\"><strong>Lockdown Mode: advanced protection for high-risk users<\/strong>\u202f&nbsp;<\/h2>\n\n\n\n<p>For users requiring an elevated level of security, such as journalists, political\u202ffigures, or executives handling sensitive information, Apple provides an advanced isolation mode. It can be activated under Settings &gt; Privacy &amp; Security &gt; Lockdown Mode.\u202f&nbsp;<\/p>\n\n\n\n<p>This feature is designed for individuals who may be exposed to targeted threats, and it works by minimizing the device&#8217;s attack surface through a series of restrictions: it automatically blocks links and attachments in messages, prevents FaceTime calls from contacts the user has not interacted with in the past\u202f30 days, restricts complex web technologies and certain fonts, disables automatic Wi-Fi\u202fconnections, and removes geolocation data from photos.\u202f&nbsp;<\/p>\n\n\n\n<p>Notably, both the Coruna and\u202fDarkSword\u202fexploit kits skip execution entirely on devices with Lockdown Mode enabled. This makes it one of the most effective countermeasures available for high-value targets.\u202f&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-your-smartphone-is-a-digital-vault-protect-it-accordingly-nbsp\"><strong>Your smartphone is a digital vault: protect it accordingly<\/strong>\u202f&nbsp;<\/h2>\n\n\n\n<p>One\u202ffinal, essential awareness: the smartphone is today an archive of personal and professional information. Its protection is not merely a technical matter, but a daily practice of prudence and digital responsibility.\u202f&nbsp;<\/p>\n\n\n\n<p>When an exploit kit like Coruna can silently compromise a device through a simple webpage visit, the boundary between personal security and organizational risk becomes invisible. A compromised executive phone can expose credentials, internal communications, and strategic data.\u202f&nbsp;<\/p>\n\n\n\n<p>This is why a comprehensive security posture requires not only endpoint protection, but also a robust\u202f<a href=\"https:\/\/neverhack.com\/en\/offers\/incident-response\" target=\"_blank\" rel=\"noreferrer noopener\">incident response capability<\/a>\u202fthat can detect, contain, and remediate compromises before they escalate into full-scale breaches.\u202f&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>New attacks, zero-click vulnerabilities, and unpatched devices. Here is what is happening to Apple devices and the essential rules for defending against potential intrusions on phones and computers.\u202f\u00a0 What we found: Coruna is not a reason for panic, but it is a wake-up call\u202f&nbsp; For users, the discovery of Coruna should not trigger\u202falarm, but rather &hellip; <a href=\"https:\/\/neverhack.com\/b\/en\/blog\/how-to-stop-the-coruna-exploit-kit-targeting-iphones-and-macs\/\">Continued<\/a><\/p>\n","protected":false},"author":12,"featured_media":2960,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[70],"tags":[],"class_list":["post-2957","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-trends"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.5 (Yoast SEO v26.5) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>How to\u202fstop the Coruna\u202fexploit\u202fkit\u202ftargeting iPhones and Macs\u00a0 - Neverhack<\/title>\n<meta name=\"description\" content=\"The Coruna exploit kit targets iPhones\u202fand Macs with 23 exploits. How it works, what risks it poses, and how to protect your Apple devices\" \/>\n<meta name=\"robots\" content=\"noindex, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to\u202fstop the Coruna\u202fexploit\u202fkit\u202ftargeting iPhones and Macs\u00a0\" \/>\n<meta property=\"og:description\" content=\"The Coruna exploit kit targets iPhones\u202fand Macs with 23 exploits. How it works, what risks it poses, and how to protect your Apple devices\" \/>\n<meta property=\"og:url\" content=\"https:\/\/neverhack.com\/b\/en\/blog\/how-to-stop-the-coruna-exploit-kit-targeting-iphones-and-macs\/\" \/>\n<meta property=\"og:site_name\" content=\"Neverhack\" \/>\n<meta property=\"article:published_time\" content=\"2026-04-09T13:07:52+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/neverhack.com\/b\/app\/uploads\/2026\/04\/Coruna-Exploit-Kit-neverhack.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1376\" \/>\n\t<meta property=\"og:image:height\" content=\"768\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Ciro PANICO\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ciro PANICO\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/neverhack.com\/b\/en\/blog\/how-to-stop-the-coruna-exploit-kit-targeting-iphones-and-macs\/\",\"url\":\"https:\/\/neverhack.com\/b\/en\/blog\/how-to-stop-the-coruna-exploit-kit-targeting-iphones-and-macs\/\",\"name\":\"How to\u202fstop the Coruna\u202fexploit\u202fkit\u202ftargeting iPhones and Macs\u00a0 - Neverhack\",\"isPartOf\":{\"@id\":\"https:\/\/neverhack.com\/b\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/neverhack.com\/b\/en\/blog\/how-to-stop-the-coruna-exploit-kit-targeting-iphones-and-macs\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/neverhack.com\/b\/en\/blog\/how-to-stop-the-coruna-exploit-kit-targeting-iphones-and-macs\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/neverhack.com\/b\/app\/uploads\/2026\/04\/Coruna-Exploit-Kit-neverhack.jpg\",\"datePublished\":\"2026-04-09T13:07:52+00:00\",\"author\":{\"@id\":\"https:\/\/neverhack.com\/b\/#\/schema\/person\/242fd3c033376be457fb8e56fe6c9103\"},\"description\":\"The Coruna exploit kit targets iPhones\u202fand Macs with 23 exploits. How it works, what risks it poses, and how to protect your Apple devices\",\"breadcrumb\":{\"@id\":\"https:\/\/neverhack.com\/b\/en\/blog\/how-to-stop-the-coruna-exploit-kit-targeting-iphones-and-macs\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/neverhack.com\/b\/en\/blog\/how-to-stop-the-coruna-exploit-kit-targeting-iphones-and-macs\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/neverhack.com\/b\/en\/blog\/how-to-stop-the-coruna-exploit-kit-targeting-iphones-and-macs\/#primaryimage\",\"url\":\"https:\/\/neverhack.com\/b\/app\/uploads\/2026\/04\/Coruna-Exploit-Kit-neverhack.jpg\",\"contentUrl\":\"https:\/\/neverhack.com\/b\/app\/uploads\/2026\/04\/Coruna-Exploit-Kit-neverhack.jpg\",\"width\":1376,\"height\":768},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/neverhack.com\/b\/en\/blog\/how-to-stop-the-coruna-exploit-kit-targeting-iphones-and-macs\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/neverhack.com\/b\/en\/home-en\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to\u202fstop the Coruna\u202fexploit\u202fkit\u202ftargeting iPhones and Macs\u00a0\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/neverhack.com\/b\/#website\",\"url\":\"https:\/\/neverhack.com\/b\/\",\"name\":\"Neverhack\",\"description\":\"Advanced cybersecurity solutions\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/neverhack.com\/b\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/neverhack.com\/b\/#\/schema\/person\/242fd3c033376be457fb8e56fe6c9103\",\"name\":\"Ciro PANICO\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"How to\u202fstop the Coruna\u202fexploit\u202fkit\u202ftargeting iPhones and Macs\u00a0 - Neverhack","description":"The Coruna exploit kit targets iPhones\u202fand Macs with 23 exploits. How it works, what risks it poses, and how to protect your Apple devices","robots":{"index":"noindex","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"How to\u202fstop the Coruna\u202fexploit\u202fkit\u202ftargeting iPhones and Macs\u00a0","og_description":"The Coruna exploit kit targets iPhones\u202fand Macs with 23 exploits. How it works, what risks it poses, and how to protect your Apple devices","og_url":"https:\/\/neverhack.com\/b\/en\/blog\/how-to-stop-the-coruna-exploit-kit-targeting-iphones-and-macs\/","og_site_name":"Neverhack","article_published_time":"2026-04-09T13:07:52+00:00","og_image":[{"width":1376,"height":768,"url":"https:\/\/neverhack.com\/b\/app\/uploads\/2026\/04\/Coruna-Exploit-Kit-neverhack.jpg","type":"image\/jpeg"}],"author":"Ciro PANICO","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Ciro PANICO","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/neverhack.com\/b\/en\/blog\/how-to-stop-the-coruna-exploit-kit-targeting-iphones-and-macs\/","url":"https:\/\/neverhack.com\/b\/en\/blog\/how-to-stop-the-coruna-exploit-kit-targeting-iphones-and-macs\/","name":"How to\u202fstop the Coruna\u202fexploit\u202fkit\u202ftargeting iPhones and Macs\u00a0 - Neverhack","isPartOf":{"@id":"https:\/\/neverhack.com\/b\/#website"},"primaryImageOfPage":{"@id":"https:\/\/neverhack.com\/b\/en\/blog\/how-to-stop-the-coruna-exploit-kit-targeting-iphones-and-macs\/#primaryimage"},"image":{"@id":"https:\/\/neverhack.com\/b\/en\/blog\/how-to-stop-the-coruna-exploit-kit-targeting-iphones-and-macs\/#primaryimage"},"thumbnailUrl":"https:\/\/neverhack.com\/b\/app\/uploads\/2026\/04\/Coruna-Exploit-Kit-neverhack.jpg","datePublished":"2026-04-09T13:07:52+00:00","author":{"@id":"https:\/\/neverhack.com\/b\/#\/schema\/person\/242fd3c033376be457fb8e56fe6c9103"},"description":"The Coruna exploit kit targets iPhones\u202fand Macs with 23 exploits. How it works, what risks it poses, and how to protect your Apple devices","breadcrumb":{"@id":"https:\/\/neverhack.com\/b\/en\/blog\/how-to-stop-the-coruna-exploit-kit-targeting-iphones-and-macs\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/neverhack.com\/b\/en\/blog\/how-to-stop-the-coruna-exploit-kit-targeting-iphones-and-macs\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/neverhack.com\/b\/en\/blog\/how-to-stop-the-coruna-exploit-kit-targeting-iphones-and-macs\/#primaryimage","url":"https:\/\/neverhack.com\/b\/app\/uploads\/2026\/04\/Coruna-Exploit-Kit-neverhack.jpg","contentUrl":"https:\/\/neverhack.com\/b\/app\/uploads\/2026\/04\/Coruna-Exploit-Kit-neverhack.jpg","width":1376,"height":768},{"@type":"BreadcrumbList","@id":"https:\/\/neverhack.com\/b\/en\/blog\/how-to-stop-the-coruna-exploit-kit-targeting-iphones-and-macs\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/neverhack.com\/b\/en\/home-en\/"},{"@type":"ListItem","position":2,"name":"How to\u202fstop the Coruna\u202fexploit\u202fkit\u202ftargeting iPhones and Macs\u00a0"}]},{"@type":"WebSite","@id":"https:\/\/neverhack.com\/b\/#website","url":"https:\/\/neverhack.com\/b\/","name":"Neverhack","description":"Advanced cybersecurity solutions","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/neverhack.com\/b\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/neverhack.com\/b\/#\/schema\/person\/242fd3c033376be457fb8e56fe6c9103","name":"Ciro PANICO"}]}},"lang":"en","translations":{"en":2957},"pll_sync_post":[],"_links":{"self":[{"href":"https:\/\/neverhack.com\/b\/wp-json\/wp\/v2\/posts\/2957","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/neverhack.com\/b\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/neverhack.com\/b\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/neverhack.com\/b\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/neverhack.com\/b\/wp-json\/wp\/v2\/comments?post=2957"}],"version-history":[{"count":5,"href":"https:\/\/neverhack.com\/b\/wp-json\/wp\/v2\/posts\/2957\/revisions"}],"predecessor-version":[{"id":2963,"href":"https:\/\/neverhack.com\/b\/wp-json\/wp\/v2\/posts\/2957\/revisions\/2963"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/neverhack.com\/b\/wp-json\/wp\/v2\/media\/2960"}],"wp:attachment":[{"href":"https:\/\/neverhack.com\/b\/wp-json\/wp\/v2\/media?parent=2957"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/neverhack.com\/b\/wp-json\/wp\/v2\/categories?post=2957"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/neverhack.com\/b\/wp-json\/wp\/v2\/tags?post=2957"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}