Ad Fraud Actors Adopt Coruna Exploit Tactics to Evade Detection

ADEX, a traffic validation ecosystem based in Limassol, uncovered this shift after tracking campaigns across Europe and India. The core mechanism mirrors the Coruna exploit identified in March 2026, which vetted iPhone models and iOS versions to serve payloads only to targeted devices. In the current ad fraud landscape, this logic allows malicious entities to present benign landing pages to automated scanners while redirecting genuine users to prohibited destinations.

While the visual presentation of these ads constantly shifts—masquerading as everything from social media promotions to financial services—the underlying delivery infrastructure remains static. ADEX analysts identified consistent patterns in redirect chains, script execution, and hosting behaviors among approximately 50 active accounts linked to Asian-based advertisers. These findings suggest that relying on visual content for fraud detection is no longer sufficient.

Furthermore, the investigation highlights a lingering risk associated with older hardware. Much like the Coruna exploit, which targeted legacy devices such as the iPhone 6s and original iPad mini 4, these fraudulent campaigns exploit the vulnerabilities of older systems that often lack the latest security patches. Traffic-quality teams are now urged to scrutinize legacy device traffic with the same rigor as modern smartphone activity to prevent the infiltration of these reconfigured threat vectors.