TLDR
A sophisticated exploit kit called Coruna is actively targeting vulnerable iPhones to steal crypto wallet data, including seed phrases and QR codes.
- Coruna uses 23 iOS vulnerabilities to compromise iPhones and extract recovery phrases, QR codes, and wallet app data from devices used for crypto.
- The main risk is for users on iOS 13.0 to 17.2.1 who visit fake gambling or crypto sites, but Apple has patched the bugs in iOS 17.3 and later.
- Crypto users can materially reduce risk by updating iOS, using hardware wallets, and never storing seed phrases or keys in notes, photos, or on-device hot wallets.
Deep Dive
1. How The Coruna Exploit Works
Googles Threat Intelligence Group has identified Coruna as a powerful iPhone exploit kit with five exploit chains and 23 vulnerabilities that can compromise iOS 13 through 17.2.1 devices when users hit a malicious website. Reports note that it exploits Apples WebKit browser engine, then escalates privileges so attackers can run code outside the browser sandbox and install a data stealing payload.
Once in, Coruna can scan the device for cryptocurrency related content, including wallet directories, photos containing QR codes, and text like backup phrase or seed phrase, enabling attackers to reconstruct wallet access and drain funds. Coverage from Crypto.news and CoinEdition describes this as a shift from state grade surveillance tooling into retail focused theft that specifically targets crypto holders.
This is not a simple phishing popup but a visit to compromise chain where just visiting the wrong site on an unpatched iPhone can expose your wallets.
2. Who Is Most At Risk
Multiple reports state that Coruna targets iPhones running iOS 13.0 to 17.2.1, with the exploit delivered via fake gambling, finance, or crypto exchange sites that are seeded as watering holes for traders. Google attributes recent financially motivated use to a group dubbed UNC6691, which deploys the kit broadly through scam finance pages and fake exchanges such as WEEX clones.
Apple has already patched key vulnerabilities, including the WebKit bug CVE 2024 23222, in iOS 17.3, and researchers emphasize that Coruna does not affect the newest releases. That means the highest risk cluster is unpatched or older hardware plus high risk browsing habits, particularly on obscure DeFi or gambling sites.
3. Practical Risk Reduction For Crypto Users
Security analysts consistently recommend three layers of defense for crypto users on iPhone in light of Coruna. First, running the latest iOS and, where possible, enabling Apples Lockdown Mode, which blocks this class of WebKit exploit according to detailed breakdowns from Google and summarized by outlets like Coinspeaker and Crypto.news.
Second, minimizing hot wallet exposure on mobile, for example by keeping larger balances in hardware wallets and treating mobile wallets as spending accounts rather than long term stores of value. Third, avoiding storage of seed phrases, private keys, or recovery QR codes in Notes, screenshots, cloud synced photo libraries, or unencrypted files that such malware specifically scans for, as highlighted in coverage by Coinspeaker.
Crypto users who update promptly, limit what their phone can reveal, and avoid shady crypto or gambling sites keep most of the practical advantage over this exploit.
Conclusion
Coruna shows how iPhone users can no longer rely on default platform security when they also carry significant crypto value on their phones. The real risk is not just a buggy browser, but powerful exploit chains now focused on extracting wallet access. Keeping devices current, tightening wallet hygiene, and moving long term holdings off phones materially shifts the odds back in favor of the user.
CoinsKid.Com