A sophisticated suite of government-developed hacking tools, dubbed 'Coruna' and capable of compromising iPhones running iOS 13 to 17.2.1, has reportedly leaked and is now being utilized by cybercriminals. Google initially identified the exploit kit in February 2025, noting its use by a surveillance vendor for a government customer, then by a Russian espionage group targeting Ukrainian users, and later by a financially motivated hacker in China. Security researchers warn of an emerging 'secondhand' market for such exploits, highlighting the critical risk when state-developed tools fall into the wrong hands. The mobile security company iVerify linked Coruna to the U.S. government, emphasizing the inevitability of leaks with widespread tool use. This incident mirrors past leaks, such as the NSA's EternalBlue, which was later used in the WannaCry ransomware attack.