Apple backports iOS fixes as Coruna links to ad fraud

ADEX identified similarities between the filtering methods used by the Coruna iOS exploit kit and techniques seen in fraudulent advertising campaigns, linking a mobile security threat to patterns associated with ad fraud.

Apple backported security updates to iOS 15.8.7 and iOS 16.7.15 for older devices, including the iPhone 6s, the original iPad mini 4 and the first-generation iPhone SE. The patches addressed vulnerabilities tied to Coruna, a modular exploit framework documented by Google's Threat Intelligence Group and linked by researchers to the same code base as Operation Triangulation.

The overlap, according to ADEX, centres on visitor filtering. In both cases, software checks a user's device characteristics before deciding what content to serve, showing harmless material to some visitors while delivering malicious or prohibited content to others.

Coruna checks factors including iPhone model and iOS version before deciding whether to deploy an exploit chain. This helps the framework avoid exposing itself to researchers, automated security tools and users outside its target criteria.

In ad fraud, comparable filtering can show one page to automated checks and a different destination to selected users. That makes the visible advert a weaker identifier, because campaign themes can change while the underlying delivery methods remain similar.

Shared tactics

The issue has drawn attention because Coruna has been described as an example of surveillance methods spreading into wider criminal use. Material released by ADEX said the exploit kit had moved from commercial surveillance use to financially motivated attacks targeting crypto wallets by the end of 2025.

The framework is built as a modular system, with separate exploit components connected by common utilities and loaders. Different exploit and bypass combinations are used for different iOS version ranges, including one for iOS 13 through 14.x, another for iOS 15 through 16.2, and three more covering iOS 16.3 to 17.2.1.

Several of the vulnerabilities involved are already public. They include CVE-2024-23222, a WebKit type confusion flaw previously exploited as a zero-day before Apple patched it in iOS 17.3, along with older issues including CVE-2021-30952 and kernel vulnerabilities dating back to 2020.

ADEX said fingerprinting itself is not unusual, as websites, analytics services and security products all use device and browser data. The distinction, it said, lies in what happens after that data is collected.

"The same fingerprinting and filtering techniques used by the Coruna exploit kit to avoid detection are appearing in fraudulent advertising campaigns," said Vlad White, Head of Media Relations, AdTech Holding.

Ad fraud patterns

ADEX observed comparable campaigns in several regions, including Europe and India. Many were traced to advertisers based in Asia, and about 50 accounts were identified as being used to run similar activity.

The company shared the information with relevant clients for review and action. The campaigns also frequently changed their visible content, with one presenting a social media offer and another appearing as a financial service, despite relying on similar delivery infrastructure.

That pattern means the creative or landing page can mislead investigators trying to connect campaigns. Stronger indicators can be found in technical delivery behaviour, including redirect chains, iframe activity, scripts and hosting patterns.

Older devices

The case has also renewed focus on the risks facing legacy Apple devices that remain in daily use. Apple rarely issues backported patches for software versions this old, making the updates notable for users of older iPhones and iPads.

ADEX said traffic quality teams should not dismiss older device traffic simply because newer systems have already been updated. Legacy devices, it argued, remain relevant both as potential targets for exploitation and as part of the wider fraud landscape.

Researchers have also drawn a direct historical line between Coruna and the earlier Operation Triangulation campaign. According to material cited by ADEX, two Coruna exploits target the same vulnerabilities used as zero-days in that 2023 campaign, and later code comparisons concluded that Coruna's kernel exploit for those bugs was an updated build of the Triangulation version.

The same comparison found that the exploit kit itself was an updated version of the earlier framework.