Google flags iPhone exploit targeting crypto wallets

TLDR

Google has disclosed a serious iPhone exploit kit called Coruna that is actively being used to steal crypto wallet data from some iOS devices.

1. Googles threat team reports that the Coruna exploit kit abuses 23 iOS bugs on iOS 13 to 17.2.1 and is now used in criminal campaigns targeting crypto users via malicious websites.
2. Once triggered, Coruna can scan an iPhone for wallet apps, QR codes, notes, and images containing seed phrases or financial data, making mobile hot wallets and stored phrases especially risky.
3. Updating to the latest iOS (17.3 or later), enabling Lockdown Mode where appropriate, avoiding fake crypto sites, and keeping large balances off phones materially reduce the risk.

Deep Dive

1. What Google Found

Googles Threat Intelligence Group describes Coruna as a powerful iOS exploit kit with five full exploit chains and 23 vulnerabilities that can compromise iPhones running iOS 13.0 through 17.2.1, but not the newest releases.Coruna exploit kit

Attackers embed the exploit in compromised or fake gambling and crypto sites. When a vulnerable iPhone visits one of these pages, JavaScript fingerprints the device, then delivers the right exploit chain to escape Safaris WebKit sandbox and gain deeper access.Google TAG summary

Originally seen in surveillance operations and watering hole attacks against Ukrainian users, Coruna has reportedly been acquired by financially motivated groups, including a China linked actor UNC6691, and repurposed for mass theft from crypto users.Espionage to theft shift

2. How It Steals From Crypto Users

Once Coruna compromises a device, the payload can scan files, photos, and app data for keywords such as backup phrase or bank account, as well as BIP39 seed phrases and QR codes.Seed phrase harvesting

Reports say it specifically targets directories and data for popular wallets like MetaMask, Trust Wallet, Phantom, Exodus, TON and others, along with any recovery phrases stored in notes or screenshots.Wallet app targets

Crucially, this is a visit to compromise style threat. You do not have to sign a malicious transaction. If your seed phrase or keys are on the device and the exploit succeeds, funds can be drained later without further interaction.

3. Practical Protection For Crypto Holders

1. Update iOS promptly. The vulnerabilities Coruna uses are patched in iOS 17.3 and later, and Google and multiple security firms explicitly recommend updating to the latest version or enabling Lockdown Mode if you cannot update.Patch and Lockdown guidance
2. Treat your phone as high risk for keys. Avoid storing seed phrases or private keys in notes, screenshots, email, or cloud documents on any mobile device. Use offline storage for recovery phrases.
3. Limit what you keep in mobile wallets. Many security teams treat mobile hot wallets as spending wallets only and keep larger holdings in hardware or other cold storage, which are not exposed to browser exploit chains.
4. Stick to trusted entry points. Type or bookmark official exchange and wallet URLs and be skeptical of ads, unsolicited links, or too good to be true offers in messages or social feeds.

Confidence: high because multiple independent crypto security reports reference the same Google research and technical details.

Conclusion

Coruna shows that iPhones are not inherently safe for storing crypto secrets when they run outdated software and visit risky sites. For crypto users, the practical takeaway is to combine basic device hygiene (current iOS, Lockdown Mode when needed) with wallet hygiene (no seeds on phones, smaller mobile balances, careful link handling) so that even if a browser exploit exists, it has nothing critical to steal.