The Coruna iOS exploit framework, evolving over seven months, uses two exploit chains targeting different iOS versions. It delivers malicious code through over 600 domains embedded in web pages without requiring app installation or user consent. The framework includes advanced native modules capable of kernel memory manipulation, Apple Mobile File Integrity state changes, process memory reads, encrypted command-and-control communication, and artifact deletion. A supply-chain compromise via the npm package art-template enables delivery through legitimate application infrastructure, bypassing domain-based defenses.