New iPhone exploit kit targets crypto wallets

TLDR

A new iPhone-focused malware kit called Coruna is stealing crypto by hunting wallet data and seed phrases on compromised devices.

1. The Coruna exploit kit infects iPhones via high-risk sites and apps, then scans for wallet vaults and seed phrases to drain funds.
2. Mobile self-custody users are most exposed, especially those using MetaMask, Bitget Wallet, or Trust Wallet and storing passwords or seeds on-device.
3. The most effective defenses are offline seed storage, limiting funds on mobile wallets, and avoiding third-party apps and risky websites.

Deep Dive

1. How The Exploit Kit Steals Wallets

Security researchers report a Coruna exploit kit that targets iPhones used for crypto. It is delivered through malicious websites, unregulated gambling platforms, fake token-claim pages, and third-party app stores.

Once active, Coruna scans the device for data directories of major non-custodial wallets and looks for encrypted vaults and seed phrases. If encryption or password storage is weak, or credentials are saved in accessible places, the malware can extract keys and empty wallets.

Unlike many scams that rely on tricking you into signing a bad transaction, this kit aims to bypass that step and steal the keys to the castle directly while you browse.

2. Who Is Most At Risk

The highest-risk profile is anyone who trades crypto on mobile using self-custody wallets and interacts with DApps and links from social media, especially in DeFi and gambling niches.

Reports say Coruna specifically targets data for wallets like MetaMask, Bitget Wallet (formerly BitKeep), and Trust Wallet. Users who store recovery phrases, private keys, or wallet passwords in Notes, screenshots, cloud-synced files, or generic password stores on the same phone are especially exposed.

Separate research on other mobile malware such as Keenadu, which has been found embedded in device firmware and can fully control installed apps including wallets, shows that mobile-focused attacks on crypto users are becoming more sophisticated and persistent.

3. Practical Defenses For iPhone Crypto Users

1. Keep seed phrases and private keys strictly offline. Do not store them in Notes, screenshots, email, generic cloud storage, or chat apps on your phone.
2. Treat your phone as a spending wallet. Use hardware or desktop wallets for savings and keep only an amount on mobile you can afford to lose if compromised.
3. Harden your device and habits. Update iOS promptly, install wallets only from official App Store links on project sites, avoid third-party app stores and shady gambling or free token pages, and use separate burner wallets for experimental DApps.

Conclusion

Coruna shows that iPhones are no longer a safe by default environment for crypto keys and that attackers are moving from simple phishing to direct key theft on mobile.

By treating mobile wallets as hot, disposable spending tools and keeping critical secrets and larger holdings in hardened setups such as hardware wallets, you can stay active in DeFi while sharply reducing catastrophic loss risk as these exploit kits spread.