Mobile Malware Evolution 2026: Coruna Exploit Kit and ZeroDayRAT Analysis

The Coruna Framework: A Paradigm Shift in iOS Exploitation\n\nThe Coruna exploit kit, also known in the intelligence community as CryptoWaters, represents one of the most sophisticated mobile threat frameworks discovered to date, utilizing 23 distinct exploits to compromise iOS devices. According to recent findings from the Google Threat Intelligence Group, this framework has been circulating among multiple threat actors since early 2025, marking a transition from exclusive commercial surveillance operations to broader government-backed and criminal campaigns Coruna iOS exploit kit uses 23 exploits. An exploit kit is a pre-packaged software system designed to automatically identify and exploit vulnerabilities on a target device to deliver a malicious payload.\n\nTechnically, Coruna is notable for its comprehensive collection of five full iOS exploit chains. These chains are engineered to bypass modern Apple mitigations using non-public exploitation techniques. While the kit is primarily effective against iOS versions 13.0 through 17.2.1, its modular design allows for rapid updates. For professionals relying on encrypted communications, the existence of such a robust framework highlights the limitations of software-only security. Even the most secure messaging apps are vulnerable if the underlying operating system is compromised at the kernel level. This has led many high-risk individuals to seek out hardware-modified phones that offer physical switches to disable microphones and cameras, providing a layer of protection that software exploits cannot bypass.\n\n## ZeroDayRAT and the Democratization of Mobile Surveillance\n\nThe emergence of ZeroDayRAT signifies a growing trend in the democratization of high-level spyware for phones. Advertised openly on Telegram as a Malware-as-a-Service (MaaS) platform, ZeroDayRAT provides even low-skilled attackers with the ability to conduct real-time surveillance on both Android and iOS devices New ZeroDayRAT Mobile Spyware Enables Real-Time Surveillance and Data Theft. A Remote Access Trojan (RAT) is a type of malware that allows an attacker to gain full administrative control over a target device, often without the user's knowledge.\n\nZeroDayRAT is designed to support a staggering range of operating systems, including Android versions 5 through 16 and iOS versions up to 26. Once installed via trojanized apps or smishing (SMS phishing) links, the malware grants the attacker access to a centralized C2 dashboard. From this interface, the operator can track live GPS locations, record the screen, activate front and back cameras, and intercept all incoming and outgoing messages. This level of access effectively nullifies standard encrypted communications by capturing data at the point of entry or display, a technique known as endpoint compromise. For those seeking a Pegasus spyware alternative for defensive testing or legitimate investigative purposes, ZeroDayRAT illustrates how commodity tools are reaching the capabilities once reserved for nation-state actors.\n\n## NFC Relay and Biometric Fraud: The New Frontier of Mobile Malware\n\nBeyond traditional data theft, new strains of mobile malware are targeting the physical and biometric interfaces of smartphones. The WindRelay malware family, often paired with the SpyNote RAT, has introduced a sophisticated method for live NFC (Near Field Communication) card-relay fraud New WindRelay Android Malware Relays Bank Cards While SpyNote RAT Controls Victim Phones. NFC is the technology that enables contactless payments. In this attack, the malware captures the live NFC exchange from a victim's bank card and relays it to an attacker-controlled device, allowing for fraudulent in-store payments or ATM withdrawals in real-time.\n\nSimultaneously, the GoldPickaxe malware has been identified stealing facial recognition data to facilitate financial fraud New ‘Gold Pickaxe’ Android, iOS malware steals your face for fraud. While it does not directly breach the Secure Enclave—the hardware-isolated processor used for biometric data—it uses social engineering to trick users into recording their faces. This data is then used to create deepfakes for bypassing banking identity verification. These developments suggest that mobile surveillance is shifting from passive data collection to active financial exploitation, necessitating a move toward hardware surveillance countermeasures and more robust mobile forensics protocols during incident response.\n\n## Cellular Interception and Network-Level Vulnerabilities\n\nWhile much focus is placed on device-side malware, cellular interception remains a critical threat vector for corporate and investigative professionals. Attackers are increasingly utilizing rogue base stations and Man-in-the-Middle (MitM) attacks to intercept unencrypted traffic or push malicious updates to devices Mobile Security Threats 2025: Malware, Phishing & Statistics. These network-level attacks can be used to deliver zero-click exploits, which require no user interaction to infect a device. \n\nIn 2024 alone, an average of 2.8 million mobile attacks were launched monthly, a number that continues to climb as attackers exploit the gap between personal device usage and corporate security policies The mobile threat landscape in 2024. The use of encrypted phones with hardened operating systems and integrated VPNs is no longer optional for those handling sensitive data. Furthermore, the recent discovery of tools like Cellebrite being used in extrajudicial contexts underscores the importance of anti-forensic measures and device encryption that can withstand advanced mobile forensics extraction Citizen Lab Finds Cellebrite Tool Used on Kenyan Activist’s Phone in Police Custody.\n\n## Key Takeaway\n\nThe mobile threat landscape in 2026 is defined by the industrialization of exploits and the convergence of surveillance with financial crime. The Coruna kit proves that even hardened iOS environments are subject to multi-chain exploits, while ZeroDayRAT demonstrates that high-level surveillance capabilities are now available as a commodity service. To mitigate these risks, organizations must look beyond software patches and adopt a defense-in-depth strategy that includes hardware-level security, end-to-end encryption, and rigorous network monitoring to detect cellular interception and unauthorized data exfiltration.\n\nThis analysis is provided for educational and security awareness purposes only; the use of surveillance software is subject to strict legal regulations.