New iPhone exploit kit endangers crypto wallets

TLDR

A sophisticated iPhone exploit kit called Coruna is actively being used to steal crypto wallet data from vulnerable iOS devices.

1. Coruna chains together 23 iOS vulnerabilities to infect iPhones via malicious websites, mainly on iOS 1317.2.1.
2. Once installed, it scans your phone for wallet recovery phrases, screenshots and financial data, letting attackers drain crypto wallets remotely.
3. Updating to the latest iOS, avoiding shady sites and keeping seed phrases off your phone significantly reduces risk, especially if you pair this with a hardware wallet.

Deep Dive

1. What Coruna Actually Is

Googles Threat Intelligence Group identified Coruna, an advanced iOS exploit kit with five full exploit chains and 23 vulnerabilities that target iPhones from iOS 13 up to 17.2.1. It compromises devices when users simply visit a booby-trapped web page, using a JavaScript framework to fingerprint the phone model and software, then delivering a tailored WebKit-based remote code execution payload without any clicks required. Researchers first saw Coruna in 2025 in nation-state surveillance campaigns, but it has since migrated into broader cybercrime, including campaigns on fake crypto and finance sites targeting retail users. Newer iOS versions (17.3 and later) have patched the vulnerabilities exploited by Coruna, according to analyses from Google and independent security firms, so fully updated devices are much harder to target.

2. How Crypto Wallets Are Being Targeted

In recent campaigns, Coruna is deployed via fake gambling sites and cloned crypto exchanges that specifically aim at iPhone users. Once the exploit lands, payloads scan the device for sensitive data, including images and files containing keywords like backup phrase, seed phrase or bank account, as reported in detailed breakdowns from security researchers covering Corunas crypto focus. Other reports note it scraping BIP39 seed phrases for self-custody wallets such as MetaMask and managed wallets accessed via mobile browsers or apps. Because many users store recovery phrases as photos, notes or PDF backups on the same phone they trade with, a successful compromise can give attackers everything needed to empty hot wallets across chains in a single move.

3. Practical Steps To Reduce Risk

Security teams and Apples own guidance converge on a few immediate defenses:

1. Update to the latest iOS version; Corunas known chains do not work against fully patched releases (Apple fixed the exploited bugs in 17.3 and later).
2. Enable Lockdown Mode if you are high risk, since it restricts the advanced web features Coruna abuses.
3. Stop storing seed phrases on phones at all: no screenshots, photos, note apps or cloud drives tied to the device.

For meaningful amounts, a hardware wallet that requires physical button confirmation for outbound transactions greatly reduces the impact if your phone is compromised, because the attacker still lacks the hardware signer.

Conclusion

Coruna illustrates how spyware-grade iPhone exploits are now pointed directly at retail crypto users, with wallet recovery data as the primary prize. The most effective response is not panic trading, but tightening your operational security: keep your iOS current, segregate devices you use for high-risk browsing from those tied to large wallets, and move recovery phrases and long-term holdings off your phone and onto hardened storage.