In March 2026, a significant cybersecurity issue was brought to light by Google’s Threat Intelligence Group (GTIG). They disclosed details about ‘Coruna’, a sophisticated iOS exploit kit incorporating five exploit chains and 23 exploits, targeting iOS versions from 13.0 to 17.2.1. The most illuminating part of this revelation was the intricate process that occurred before the actual execution of the exploit.
Understanding Pre-Delivery Tactics
The ‘Coruna’ exploit was distinctly selective about its targets. It utilized a JavaScript fingerprinting module to determine if a visitor was using a genuine device, identifying the iPhone model and iOS version. Only upon meeting these criteria did the framework activate an appropriate exploit. This preemptive filtering ensured that researchers, lockdown-mode devices, and private browsing sessions were effectively bypassed.
For defenders, the investigation typically begins with the payload. However, from the operator’s perspective, the payload represents the culmination of a meticulously orchestrated process involving traffic acquisition, routing, and qualification, often carried out in plain sight.
The Structure of Malware Campaigns
Modern malware operations can be viewed as sophisticated delivery systems. Typically, such a campaign comprises five stages: acquisition through ads or compromised sites, routing via redirectors, trusted infrastructure to mask malicious activity, visitor qualification through fingerprinting, and persuasion using deceptive download pages or alerts.
A case study from June 2026 by Check Point Research highlighted fake open-source download sites. These sites loaded scripts from Amazon CloudFront, directing users through a Traffic Distribution System (TDS), with these TDS scripts operational since December 2025. This indicates that the infrastructure was in place well before the actual malware deployment.
Ad Platform Insights and Detection
Ad platforms like PropellerAds have a unique vantage point, seeing aspects of the malware delivery process that endpoint tools might miss. They scrutinize campaigns at multiple stages: submission, moderation, and post-launch. This includes analyzing redirect paths, scripts, and traffic behavior to identify potential threats.
In one detailed ADEX investigation, about 50 advertiser accounts were linked through a similar delivery setup, despite appearing unrelated on the surface. This setup involved complex cloaking techniques, such as hidden iframes and IP filtering, emphasizing the need for ad platforms to focus on behavioral patterns rather than content alone.
Shifts in Malware Campaign Strategies
Recent data from ADEX’s Trust & Safety report for 2026 shows a shift in the composition of rejected or suspended campaigns. While cloaking remains a primary reason for suspension, new categories like device-specific scripts have emerged, accounting for a significant portion of rejections. The use of artificial intelligence has accelerated the ability of malicious campaigns to adapt and reappear quickly after being blocked.
Ultimately, moving beyond payload detection to understanding the entire delivery path offers a strategic advantage. By piecing together the full journey, from acquisition to payload, cybersecurity teams can preemptively identify and mitigate threats, connecting seemingly unrelated incidents through shared delivery tactics.
