Here's a cybersecurity story that feels like it's straight out of a spy novel, but it's very real. Alphabet Inc. (GOOGL)'s threat hunters have been poking around in the digital shadows and found something unsettling: a hacking tool targeting older iPhones that might have originally been built by the U.S. government.
In a research note published Tuesday, the Google Threat Intelligence Group (GITG) detailed its discovery of an exploit kit it's calling "Coruna." This isn't some amateur script. It's a tool designed to hack into iPhone models running iOS versions from 13.0 (released back in 2019) all the way up to 17.2.1 (from late 2023). The good news? It doesn't work on the latest iOS versions. The bad news? A lot of people don't update their phones right away.
So how did Google stumble upon this? The group says it first spotted the kit when a surveillance vendor—one of those companies that sells spyware to governments—was trying to hack into someone's phone. Then they saw the same tool being used in attacks against Ukrainian users by suspected Russian actors. And then, for a hat trick, they observed Chinese hackers with financial motives using it too. That's quite the resume for one piece of malware.
GITG admits it's not entirely clear how all these different bad guys got their hands on the same kit, but they point to what they call an "active market for 'second hand' zero-day exploits." Think of it like a black market for digital lockpicks. A powerful tool gets developed, maybe by a government agency for intelligence gathering, and then somehow it leaks out or gets sold. Once it's out in the wild, it gets passed around to anyone who can pay, from state-sponsored hackers to cybercriminals just looking to steal money.
"iPhone users are strongly urged to update their devices to the latest version of iOS," the Google group said, in what might be the most important piece of advice you'll read today. It's the digital equivalent of locking your door.
The Plot Thickens: A Possible U.S. Origin Story
If the story ended there, it would be concerning enough. But it gets more intriguing. On the same day Google published its findings, the mobile security website iVerify put out a blog post of its own. They also identified the exploit kit and made a bold claim: "This is the first observed mass exploitation of mobile phones, including iOS, by a criminal group using tools likely built by a nation-state."
iVerify says it has "evidence" suggesting the tool was "a leaked U.S. government framework." Their reasoning? They see similarities between Coruna and something called EternalBlue. That name might ring a bell for cybersecurity watchers. EternalBlue was a devastating exploit kit targeting Microsoft Corp's (MSFT) Windows operating system. It was reportedly developed by the U.S. National Security Agency (NSA), and its leak in 2017 led to global chaos, powering worms like WannaCry that caused billions in damage.
The implication is clear: just as a powerful U.S. cyber weapon leaked and was used against the world years ago, history might be repeating itself with a tool aimed at Apple Inc.'s (AAPL) iPhone.
Cybersecurity in the Spotlight: AI, the Pentagon, and Policy Fights
This discovery lands in the middle of a much bigger conversation about technology, security, and government. Cybersecurity is having a moment in the policy arena.
President Donald Trump recently directed all federal agencies to stop using AI technology from a company called Anthropic. The administration criticized what it called harsh restrictions on lawful military applications, and Anthropic has been effectively blacklisted.
Meanwhile, the Department of War, under Secretary Pete Hegseth, has gone in a different direction. It reached an agreement with Sam Altman's OpenAI to deploy its AI tools inside the Pentagon's classified systems. Notably, the deal includes OpenAI's terms, which reportedly prohibit domestic mass surveillance and require human oversight for the use of force.
Anthropic's CEO, Dario Amodei, has defended his company, emphasizing its "patriotic stance" and noting it was the first AI company to assist the defense community in a classified capacity. It's a messy, high-stakes debate about who builds the tools of modern security and what rules should govern them.
The Coruna discovery is a stark reminder of one potential consequence of that ecosystem: when incredibly sophisticated tools are created, they don't always stay in the right hands. A tool built for one purpose can be repurposed, leaked, or sold, ending up in a criminal's toolkit to target ordinary people's iPhones.
As for the companies involved, Alphabet shares slipped 0.41% to $302.32 in pre-market trading Wednesday. The broader takeaway for investors and everyone else, however, is about risk. The digital arms race creates complex vulnerabilities, and the line between national security tools and consumer threats is getting blurrier by the day. The simplest defense, for now, remains the same: update your phone.
