Coruna Unleashed: Deep Dive into the Stealthy Multi‑Stage Browser Exploit Framework Bypassing Apple’s PAC on iOS/macOS + Video

By /

Listen to this Post

Featured Image

Introduction:

Coruna is a sophisticated, multi‑stage browser exploit framework targeting Apple’s Safari/WebKit engine on ARM64 (arm64e) devices running iOS and macOS. Delivered via watering‑hole compromise, the entire attack chain executes within the browser context – parsing Mach‑O binaries from JavaScript, scanning system framework memory for ROP/JOP gadgets, bypassing Apple’s Pointer Authentication Codes (PAC), escaping the JIT cage, and establishing command‑and‑control communication – all without dropping a single file to disk. This technical teardown dissects each stage, providing security professionals with a clear understanding of the attack mechanics and actionable mitigation strategies.

Learning Objectives:

  • Understand the multi‑stage architecture of the Coruna exploit framework.
  • Analyze the techniques used for in‑memory Mach‑O parsing and gadget scanning.
  • Explore the method for bypassing Apple’s Pointer Authentication Codes (PAC).
  • Learn how the JIT cage is escaped and fileless C2 communication is established.
  • Identify detection and prevention measures against such in‑memory browser‑based attacks.

You Should Know:

1. Watering‑Hole Delivery and Initial Compromise

Coruna begins with a watering‑hole attack: an attacker compromises a website frequently visited by the target group and injects a malicious JavaScript payload. When the victim’s browser loads the page, the exploit chain is triggered. This initial payload is small and obfuscated, designed to fingerprint the system and load the next stage only if the conditions match (e.g., ARM64, specific OS versions).

Step‑by‑step guide (conceptual):

  1. Identify target site – Use reconnaissance to find a site trusted by the intended victims.
  2. Inject malicious script – Through SQL injection, XSS, or stolen credentials, embed a `