Coruna Exploit Kit Encrypted Payload Download

Brandon Rodriguez@BMRodriguez

•updated Mar 18, 2026•6•0•98

This detection identifies network requests matching a URL pattern used by the Coruna iOS exploit kit to deliver encrypted binary payloads. The framework generates resource URLs using a 40-character hash and serves them as files ending in ".min.js".