> be me > get on xibbler > group of nerds do php exploit poc thingie > make sassy repost > nerd fight ensues > forgot dont like nerd fights > delete post > get off xibbler > eat sandwich > get back on xibbler > "i wonder if its calmed down" infosec xibbler:

> make post about Coruna Exploit Kit > initially identified by @malwrhunterteam > share my thoughts, confirmations > share the goop > get off beep boop > come back > stinky nerds arrive on the scene > stinky nerds doing detective research > @AelsMartin identifies 183 other websites carrying it > @duniel_pls identifies infection vector being vulnerable PrestaShop instances > @ffforward retrohunt sees campaign since at least July, 2026 WHOOWEE BOIS WE GOT OURSELVES A STATE SPONSORED CAMPAIGN *I'm being intentionally hyperbolic for comedic effect, Google Threat Intelligence linked Coruna Exploit Kit to a Chinese financially motivated Threat Group in late 2025. However, Coruna has historically been state-sponsored, and to the best of my knowledge no information available has determined how state-sponsored malware deriving from the United States fell into the hands of Chinese Threat Actors. There is lots of speculation, big that's a lot of anime lore for this post

> be @malwrhunterteam > on a legendary run on social media > find silly website > estrosa-dot-it > website for italian cosmetics > legit website, used by the pasta people > notice something silly on website > /js/analytics/assets/js/group.html > look inside > group.html checks browser agent > detects iOS version > loads different files depending on iOS version > loads 49554fde7424c31c.js > 49*.js doing lots of crazy stuff > layers of obfuscation and pointer arithmetic > lolwtf > look inside > exact match of Coruna EK > Coruna Exploit Kit > Coruna originally used by US government > rumored to be made by US contractor > rumored US contractor illegally sold to kremlin > UNC6353 (kremlin) found using Coruna in 2025 Chat, someone is swinging the legendary goop around. It is Coruna, the state-sponsored iOS exploit kit. All this requires is your Apple device to visit a website and (assuming you're running the targeted iOS version) you're cooked. Although, from my initial bonking of it, it appears this delivers two different payloads depending on the iOS version. Unfortunately, I know almost nothing about iOS exploitation and iOS malware, so I have no idea what I'm doing. I encouraged my peers and colleagues to review it. It is good goop. I've archived the payloads from the compromised domain. The shared link is below. pic unrelated

> be JayTaelien > security researcher > discovered Discord zero day exploit > send Twitch embed to victim > something something > massive exploit chain > arbitrary code execution > only requirement is victim clicking a Twitch embed > Discord confirms 1 ClickRCE > pays him $5,500 Dawg, someone get Discord on the horn and tell their CEO his company is a fucking piece of shit. This exploit is devastating and if this guy didn't tell them, and instead decided to weaponize it, he could have fucking destroyed end users. All bro would have had to do is be like. "Check out this Twitch streamers clip", and destroyed their machine, executing any malware they wanted arbitrarily, stealing data, whatever. Bro could have gone to large Discord channels, shared the link, potentially infecting thousands upon thousands of people effortlessly He could have down more precise operations targeting prominent streamers, moderators, celebrities known to use Discord, and fucking wiped them all out with anything he chose to execute Imagine if he sold this exploit to ransomware groups He could have made millions of dollars, easily Imagine if he went into a cryptocurrency Discord and the payload was a cryptodrainer. He could have drained entire communities in seconds And they paid bro $5,500 That's absolutely sickening. JayTaelien is a fucking saint and decides a much larger payouf

Yes, I've seen the posts about the Israeli mercenary spyware infecting mobile devices from ads on websites using zero day exploits, primarily targeting Palestinians and journalists. This is ... I think third or fourth ... Israeli firm which does something like this. Mobile spyware on this caliber unfortunately is not something I have been able to bonk. Mercenary spyware is notoriously difficult to detect and it is almost never shared publicly, in any capacity, it is usually shared with very specific researchers behind closed doors to bonk. When this sort of goop is identified it is kept close to the chest of security companies or researchers because they do not want the governments, or individuals developing it, to know what they know about their mobile goop. It's basically ultra mega fuck off super goop which can be acquired by ultra mega fuck off secret top secret goop acquisition specialists. I'm aware several governments purchase these sort of exploits and spyware and use it, including the United States government, specifically ICE I just don't have the goop bro