This iOS 'Exploit' Kit Can Hack Vulnerable iPhones Using 23 Different Attacks

Google’s Threat Intelligence Group disclosed “Coruna,” an exploit kit using 23 iOS exploits (compiled into five full exploit chains) to deliver a root-capable loader called PlasmaLoader to iPhones running iOS 13.0 through 17.2.1; Apple’s current iOS 26 is not vulnerable. Coruna has been observed in multiple campaigns—linked to a surveillance-vendor customer (Feb 2025), a suspected Russian espionage operation (July), and financially motivated Chinese actors (Dec)—and can run additional modules and harvest text snippets likely aimed at stealing financial data. Google and iVerify report some techniques remain non-public and un-CVEd, about 5% of iPhone users may still be vulnerable in China (potentially tens of thousands), and users are urged to update to the latest iOS or enable Lockdown Mode.

Analysis

Market structure: Coruna is a demand shock for endpoint and threat-intel vendors — expect a 3–8% lift in renewal pricing power for enterprise security vendors (CRWD, PANW, FTNT) over 6–12 months as customers accelerate spend to close exploit windows. Apple (AAPL) faces reputational noise but limited direct revenue impact: ~5% of iPhones vulnerable implies ~50m devices globally (1bn installed base), a brand hit but not an earnings shock because modern iOS versions (17.2.1+) are protected.

Risk assessment: Tail risks include geopolitically-driven export controls or sanctions on surveillance vendors and a high-profile mass breach that could trigger regulatory class actions against Apple; probability low but systemic impact high (>$5–10bn market cap swings). Timeline: immediate (days) — patch publicity/volatility spike; short-term (weeks–months) — security vendors benefit from deal acceleration; long-term (6–18 months) — potential legislative scrutiny and higher enterprise security budgets.

Trade implications: Direct plays favor security software longs and selective tech longs: overweight CrowdStrike (CRWD) and Palo Alto (PANW) for 6–12 month upside; use small, tactical AAPL downside protection rather than outright short because fixes are available. Options: favor 3-month call spreads on CRWD/PANW to capture upside while limiting premium; buy short-dated (30–60 day) AAPL puts sized to hedge 1% portfolio exposure ahead of consumer sentiment headlines.

Contrarian angle: Consensus underprices recurring-revenue tailwind for security vendors and overprices Apple downside — history (Pegasus-era headlines) shows security budgets increase materially while Apple stock recovers within months. Unintended consequence: accelerated iOS update adoption and Lockdown Mode usage could deepen Apple’s services stickiness, reducing secondary device turnover — a subtle positive for Apple over 12–24 months.

Key Decisions for Investors

• Establish a 2–3% long position in CRWD (CrowdStrike) and a 2% long in PANW (Palo Alto) over the next 4 weeks; target 12–25% upside over 6–12 months driven by accelerated enterprise spend; trim to breakeven if quarterly security ARR growth does not outpace consensus by +200bps on next earnings.
• Allocate 1–2% to HACK (ETFMG Prime Cyber Security ETF) immediately as a diversified, low-conviction play capturing broad security upside; rebalance after 3 months if the ETF outperforms CRWD+PANW by >5%.
• Purchase 30–60 day AAPL puts 2.5% OTM sized to hedge 1% of portfolio equity exposure (protect against reputation-driven drawdowns); close if implied volatility collapses >40% or after 60 days.
• Establish a 1–2% long position in GOOGL (Alphabet) to capture potential demand for threat-intel/cloud security services; add another 0.5–1% if Google announces a major security contract or product integration within 90 days.
• Monitor CVE assignments and Google’s continued technical disclosures over the next 30–60 days; if >5 previously unpatched exploits receive CVEs or active exploit count stays >10, increase security longs (CRWD/PANW/HACK) by +1–2%.