Several government tools that target iPhones are now being used by cybercriminals

Security researchers have discovered a powerful hacking tool that can compromise iPhones with outdated software that they say has passed from a government client into the hands of cybercriminals.

Google he said on Tuesday that it first recognized the equipment, called Coruna, in February 2025 during a vendor testing hacking into a person’s phone with spyware on behalf of the client’s government. It recovered the same tools months later while targeting Ukrainian users of a large Russian spy network, only to discover that it had been used by a Chinese money hacker.

It is unclear how the devices were leaked or how widespread they were, but security researchers at Google have warned of an emerging market for “secondhand” devices, which are sold to hackers for cash in order to extract more profits.

The discovery also shows how exploits and backdoors designed for government use can be leaked and ultimately exploited by cybercriminals or other non-government actors. Mobile security company iVerify found and updated the hacking tools, it said in a blog post that it linked Coruna’s weapons to the US government, based on the similarity of the weapons previously reported by the United States.

“The higher the usage, the more likely the leak will occur,” iVerify said. “While iVerify has evidence that this tool is a leaked US government system, this should not overshadow the knowledge that these tools are out in the wild and will be used recklessly by malicious actors.”

Google said the hacking tools are powerful, as they can bypass the iPhone’s security by simply visiting a malicious website with a fraudulent code – such as sending a malicious link – known as a “watering hole”. According to Google, Coruna’s tools can break the iPhone in five different ways and rely on and combine 23 threats in its digital tools. Affected devices range from iPhone models running iOS 13 to 17.2.1, which was released in December 2023.

According to Wired, which first he told a storyCoruna’s weapons contain weapons that were previously used in hacking a campaign called Operation Triangulation. The Russian company Kaspersky said that in 2023 the US government tried to hack several iPhones of its employees.

Although leaks of explosive devices are rare, they are not unknown. In 2017, the US National Security Agency discovered that the tools it had developed to attack Windows computers around the world had been hacked. The Windows backdoor, named EternalBlue, was later published and used by cybercriminals the next attackincluding 2017 WannaCry ransomware attack and North Korea.

TechCrunch also recently reported on the trial of Peter Williams, the former head of the US defense contractor L3Harris Trenchant, who was sentenced to more than seven years in prison. after pleading guilty stealing and selling eight items to a broker known to work with the Russian government.

According to prosecutors, Williams sold what he could afford hacking “millions of computers and devices” around the world. There was only one chance was sold to a South Korean broker. It is unclear whether the incident was disclosed to the developers, or patched.