Google uncovers iPhone exploit targeting crypto wallets

TLDR

Google security researchers have revealed a powerful iPhone exploit kit that targets crypto users by stealing wallet recovery data from vulnerable devices.

1. The Coruna exploit kit chains 23 iOS flaws to hack iPhones via malicious websites, including fake crypto and gambling platforms.
2. Once installed, it scans notes, photos, and wallet apps for seed phrases and keys, allowing attackers to empty wallets without user interaction.
3. Updating to the latest iOS, avoiding unknown crypto sites on mobile, and keeping large holdings off everyday phones greatly reduces exposure.

Deep Dive

1. How The Coruna Exploit Works

Googles Threat Intelligence Group identified a sophisticated iOS toolkit called Coruna that uses five exploit chains and 23 vulnerabilities against iOS 13 through 17.2.1 on iPhones, delivered through web content such as Safari and in?app browsers from compromised sites like fake crypto platforms and gambling pages.

According to reports summarizing Googles findings, Coruna fingerprints each device, then serves a tailored exploit that bypasses normal Apple security to run arbitrary code on the phone. Infections have been seen evolving from surveillance use to espionage campaigns and then to financially motivated cybercrime targeting crypto users on crypto related sites.

Researchers note that the specific vulnerabilities exploited by Coruna have been patched in newer iOS releases, so the kit does not work against fully updated devices, but many users remain on older versions.

2. Why Crypto Wallets Are A Prime Target

Once the exploit lands, payloads can scan files, images, and app data for keywords such as backup phrase and bank account, effectively hunting for recovery phrases and financial information stored anywhere on the device, including screenshots or notes of seed phrases, as described in reports on harvesting crypto wallet data.

Security research indicates that Coruna can specifically probe directories for popular wallet apps like MetaMask, Bitget Wallet, and Trust Wallet, as well as read QR codes and BIP39 seed phrases, so attackers can recreate wallets elsewhere and transfer funds without tricking the user into signing a malicious transaction.

3. Practical Defenses And What To Watch

Reports based on Googles work emphasize that Corunas known exploit chains do not work on the latest iOS versions, and recommend updating iPhones to the newest available release and considering Apples Lockdown Mode for higher risk users, as highlighted in analysis of the iPhone exploit kit.

Many security conscious crypto users keep long term holdings in hardware wallets or on dedicated devices that are fully updated and not used for casual browsing, and avoid storing seed phrases in notes, screenshots, or cloud synced documents.

Going forward, it is worth watching for Apple security advisories, wallet provider alerts, and any follow up from Googles team, since Coruna shows that state grade mobile exploits can leak into broad criminal use focused on draining crypto.

Conclusion

Googles discovery of the Coruna iPhone exploit kit shows that mobile browsers and everyday phones have become high value attack surfaces for stealing crypto wallet keys.

For crypto users, the main shift is not a new on chain risk but a device security one: keeping iOS updated, treating unknown crypto sites with extreme caution, and separating large holdings from daily use phones can materially reduce the chance that a similar exploit drains funds without warning.