Spyware once used by governments is now spreading to cybercriminals

Cybercriminal groups are now deploying sophisticated iPhone spyware tools once reserved for governments and law enforcement, including a toolkit called Coruna originally built by defense contractor L3Harris for the U.S. government and later acquired by a Chinese cybercriminal group. Researchers at Google, iVerify and Lookout discovered two active campaigns in the past month exploiting iPhone vulnerabilities through fake cryptocurrency platforms and Ukrainian news websites to extract text messages, photos, location data and browser history without requiring user clicks or downloads. The shift represents a major escalation in mobile threats because acquiring these zero-day exploits was once limited to well-funded state actors targeting activists and journalists, but the commercial spyware ecosystem has now made such tools "abundant" and accessible to lower-skilled criminals. Apple has patched the underlying vulnerabilities and deployed emergency updates, but security researchers say Lockdown Mode only partially blocks these attacks and users have limited ability to detect infection. Experts recommend keeping devices updated, enabling Lockdown Mode and installing third-party mobile security tools, though no defense is foolproof against watering hole attacks.