Coruna iOS exploit tactics are being repurposed to evade detection in fraudulent ad campaigns
Executive summary: ADEX identified that the Coruna iOS exploit kit's fingerprinting and filtering techniques are being reused in fraudulent advertising campaigns to evade detection. This reuse threatens the integrity of mobile ad ecosystems, potentially increasing fraud-related losses for advertisers and prompting stricter anti-fraud measures.
Who is involved: ADEX (AI-powered traffic validation platform), Coruna exploit kit developers, advertisers and ad networks operating on iOS.
Likely next: ADEX will publish mitigation guidelines; ad tech firms may accelerate deployment of AI-based fraud detection; regulators may review current ad fraud standards.
ADEX has observed that the fingerprinting and filtering methods originally built into the Coruna iOS exploit kit are now appearing in illegal advertising operations. This reuse allows fraudsters to disguise invalid traffic as legitimate, undermining trust in mobile ad metrics. The finding signals a need for upgraded detection tools and closer cooperation between ad tech providers and security researchers.
Timeline
- — ADEX Finds Coruna iOS Exploit Tactics Reused in Ad Fraud Campaigns (PR Newswire)
Analysis — what this means
Likely next events
- ADEX to release a detailed threat report on Coruna-derived ad fraud tactics by 2026-09-15
- Advertising Industry Group to convene a workshop on iOS-based ad fraud mitigation on 2026-10-01
Sectors affected
- mobile advertising
- ad technology
- digital marketing
Regulatory implications
- EU Digital Services Act may require platforms to demonstrate fraud mitigation measures by 2027
Historical parallels
- 2020 Zephyr botnet ad fraud scheme that used similar device fingerprinting evasion
- 2015 Operation Ghost Click that exploited DNSChanger malware for click fraud