Coruna‑like iOS Exploit Kit Traffic Observed Across Multiple Domains
What Happened — On 16 Oct 2026 Malware‑Traffic‑Analysis published PCAP files that capture network activity linked to a “Coruna‑like” iOS exploit kit. The kit distributes malicious IPA payloads via password‑protected ZIP archives hosted on several web servers. Traffic shows drive‑by HTTP requests, retrieval of the ZIP, and subsequent download of the IPA, which is then delivered to iOS devices exploiting a previously‑undisclosed vulnerability. The activity was corroborated by Unit42 and Palo Alto Networks, which noted a new password‑scheme used to hide the payloads. No public breach has been reported, but the presence of the kit indicates an active threat against iOS ecosystems.
Why It Matters for Trust & Control Assurance — The campaign underscores the need for continuous mobile‑traffic monitoring and detection controls that can surface suspicious iOS‑specific activity before a compromise occurs.
Who Is Affected — Enterprises with BYOD iOS fleets, mobile‑app developers, MDM solution providers, and any organization that permits iOS devices on its network.
Recommended Actions
- Deploy network‑level TLS‑inspection or DNS‑filtering that can flag downloads of password‑protected ZIP files from unknown domains.
- Enforce strict app‑vetting policies in MDM solutions; block unsigned or enterprise‑signed IPA files not sourced from approved stores.
- Integrate mobile‑traffic logs into a SIEM and map them to the “Detect” function of NIST CSF 2.0.
- Conduct regular threat‑intel briefings to keep security teams aware of emerging iOS exploit kits.
Technical Notes
- Attack vector: Drive‑by download of password‑protected ZIP → malicious IPA (iOS executable).
- Indicators: Multiple C2 domains, unusual HTTP User‑Agent strings, ZIP password scheme disclosed on the site’s “about” page.
- Payload: Likely a zero‑day iOS exploit (specific CVE not publicly disclosed).