PropellerAds: Why Modern Malware Delivery Starts Before the Payload

What happened?

By Farukh Rakhimov, Head of Compliance, Data Protection, and Information Security at AdTech Holding In March 2026, Google Threat Intelligence Group (GTIG) disclosed Coruna, an iOS exploit kit with five exploit chains and 23 exploits covering iOS 13.0 through 17.2.1. The most instructive part of the disclosure is what happened before the exploit got any chance to run. Coruna was amazingly picky about visitors. A JavaScript fingerprinting module checked whether the visitor was a real device, which iPhone model it was and which iOS version it ran.

Key details

• Google Threat Intelligence Group disclosed Coruna, an iOS exploit kit with five exploit chains and 23 exploits covering iOS 13.0 through 17.2.1.
• Coruna uses a JavaScript fingerprinting module to verify device model and iOS version before delivering a matching exploit, blocking researchers and Lockdown Mode devices.
• ADEX moderation data from eight ad platforms shows cloaking dropped from ~75% of suspensions in 2025 to ~45% in Q3 2026, while malicious iOS scripts became a new category at ~20%.
• Apple backported Coruna-relevant fixes to iOS 15.8.7 in March 2026, but unpatched devices remain exposed the longest.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.