Security researchers have identified a suite of powerful hacking tools capable of compromising iPhones running older software that they say has passed from a government customer into the hands of cybercriminals. Google said Tuesday that it first identified the exploit kit, dubbed Coruna, in February 2025 during a surveillance vendor’s attempt to hack into someone’s phone with spyware on behalf of a government customer. It found the same exploit kit months later targeting Ukrainian users in a broad-scale campaign by a Russian espionage group, and then later found it used by a financially motivated hacker in China. It’s unclear how the tools leaked or proliferated, but Google security researchers warned of an emerging market for “secondhand” exploits, which are sold to hackers motivated by money to extract more value out of the exploit. The discovery also shows how exploits and back doors designed to be used by governments can leak and ultimately be abused by cybercriminals or other non-state actors. Mobile security company iVerify obtained and reverse-engineered the hacking tools, saying in a blog post …