Loading story…
Kaspersky published a utility to help organizations and individuals identify traces of Operation Triangulation, an iPhone-focused espionage campaign uncovered on corporate devices. The tool is designed to detect indicators left by the attack chain, which used previously unknown iOS exploits to compromise devices through iMessage without user interaction and then deploy malware for covert data collection.
The release gives defenders a practical way to check Apple mobile devices for evidence of compromise tied to the campaign and supports incident response efforts where targeted surveillance is suspected. Operation Triangulation drew attention because it relied on a sophisticated zero-click infection path and targeted mobile endpoints that are often harder for enterprises to inspect, making forensic detection tools especially important for security teams.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Securelist published a tool intended to help users find traces of the Operation Triangulation campaign on affected devices. The reference provides no earlier incident details, so this publication is the only distinct event supported by the content.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcebleepingcomputer.com
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **Operation Triangulation**, an iPhone espionage campaign that infected devices through iMessage and deployed a sophisticated spyware implant on iOS. Reporting tied the operation to a chain of **four zero-day vulnerabilities**, including flaws in Apple’s processing of messages and a hardware-based feature that enabled attackers to bypass protections that were largely undocumented outside Apple. Kaspersky said the malware targeted iPhones used by its employees, while later technical analysis and conference presentations detailed how the implant gained code execution, escalated privileges, and maintained stealth on compromised devices. The campaign quickly drew geopolitical attention after Russian authorities accused Apple of cooperating with the **NSA** in the spying operation, an allegation that was widely reported but not substantiated by public technical evidence. Subsequent coverage focused on the exploit kit sometimes referred to as **Coruna**, with Kaspersky later saying it had found **no signs** that the toolkit was created by the United States. The case remains notable for showing that attackers combined multiple iOS zero-days with obscure Apple hardware behavior to build a highly advanced surveillance platform against iPhone users.
Jul 12, 2026
Security researchers reported a sophisticated iPhone exploitation framework dubbed **Coruna** that appears to have originated as a professionally developed, likely government-grade capability and later proliferated to foreign espionage and criminal actors. Analyses cited by Google’s Threat Intelligence Group and mobile security firm iVerify describe **five exploit chains** spanning **20+ vulnerabilities** affecting **iOS 13 through 17.2.1**, enabling delivery via malicious web content for device fingerprinting, remote code execution, and bypass of key iOS mitigations; the tool’s apparent usage trail includes alleged deployment by **Russian intelligence against Ukrainian targets** and subsequent adoption by a cybercrime group for cryptocurrency theft. Separate mobile-threat reporting detailed multiple **Android** campaigns and families emphasizing stealth, persistence, and credential theft. CloudSEK described a **RedAlert** trojanized app impersonating Israel’s Home Front Command alerting application, using a **multi-stage APK/DEX loader chain** (including an `assets/` payload) and UI mimicry while coercing high-risk permissions (e.g., Contacts, SMS, Location) and establishing C2. PolySwarm summarized **PromptSpy**, an Android RAT with VNC-based remote control that integrates **Google Gemini** to generate context-aware UI gesture instructions from screen XML dumps to improve persistence across device variants, distributed via a phishing site impersonating a bank portal and assessed as financially motivated (notably targeting Argentina). Zimperium separately profiled **ZeroDayRAT** as a modular Android spyware platform spread via social engineering and sideloading, supporting surveillance and financial theft (e.g., screen capture, keylogging, credential harvesting), underscoring continued escalation in mobile malware sophistication.
Jun 29, 2026
Researchers reported that the **Coruna** iOS exploitation framework contains full exploit chains and roughly **23 exploits** targeting iPhones running **iOS 13 through 17.2/17.2.1**, and that it has been used by multiple threat actors, including **UNC6353**, a suspected Russian espionage group conducting watering-hole attacks against Ukrainian users, and **UNC6691**, a financially motivated China-based actor. The toolkit, also referred to as **CryptoWaters**, has been described as a rare case of **nation-state-grade iPhone exploitation** appearing in broader criminal operations, with post-exploitation activity including the **PLASMAGRID** payload and persistence through a process identified as `com.apple.assistd` that injects into the `powerd` daemon running as root. Reporting also highlighted competing views on the toolkit's origin. One account said evidence suggests parts of Coruna may have originated from **Trenchant**, a hacking and surveillance division of **L3Harris**, and later leaked into the wider ecosystem, ultimately reaching foreign intelligence services and cybercriminals. However, technical threat research noted that the **definitive origin remains unconfirmed**, even as analysts observed reuse of vulnerabilities associated with **Operation Triangulation** and CISA added **`CVE-2023-41974`** to the **Known Exploited Vulnerabilities** catalog after Google's publication. The story is substantive threat intelligence, not fluff, because it concerns an active exploit framework, real-world exploitation, and possible proliferation of advanced offensive capabilities.
Jun 29, 2026