Google Uncovers iPhone Exploit Kit Targeting Crypto Wallets

TheNewsCryptoPublished on 2026-03-05Last updated on 2026-03-05

Abstract

Google's Threat Intelligence Group (GTIG) has uncovered a sophisticated iOS exploit kit, dubbed 'Coruna,' targeting iPhone users on iOS versions 13.0 to 17.2.1. The kit, which contains five complete exploit chains and approximately 23 exploits—including previously unknown ones—aims to steal cryptocurrency wallet seed phrases and sensitive financial data. First identified in February 2025, the kit has been linked to a suspected Russian espionage group targeting Ukrainians and later to fake Chinese crypto websites impersonating platforms like WEEX. When users visit these sites on vulnerable iOS devices, the kit deploys to harvest financial information, including seed phrases and credentials from apps like MetaMask and Uniswap. GTIG advises users to update to the latest iOS version or enable Lockdown Mode to mitigate such attacks.

Google’s threat researchers reveal that they have unveiled a new exploit kit aiming at Apple iPhone users, targeted at stealing crypto wallet seed phrases. The kit, referred to as ‘Coruna’ by its developers, aims at iPhones working on iOS versions 13.0 up to 17.2.1.

It contains five complete iOS exploit chains and around 23 exploits, comprising ones that were so far unknown to the public, the Google Threat Intelligence Group (GTIG) mentioned in a report on March 4.

The group revealed that it first found the kit in February 2025 and has since traced its applications by a suspected Russian espionage group against Ukrainians and then to fake Chinese crypto websites that target the theft of crypto.

GTIG further mentioned that the kit does not run with the latest version of iOS and requested iPhone users update their devices to the latest software version. If that is not possible, users should put the phone in lockdown mode, which, according to Apple, can help in countering sophisticated attacks.

What Does GTIG Further Mention?

GTIG mentioned that it came across parts of an iOS exploit in February last year in which a consumer of a surveillance company used JavaScript to fingerprint the device to offer the correct exploit.

Further, in the same year, it found the same JavaScript framework concealed on various compromised Ukrainian websites that was solely delivered to selected iPhone users from a particular geolocation.

GTIG mentioned that it found the similar substructure in December on a very big set of fake Chinese websites often associated with finance, comprising one that spoofed the crypto exchange WEEX.

When a user has access to the website with an iOS device, the substructure gives the exploit kit and hunts for financial information, comprising analysing texts having seed phrases and keywords like ‘backup phrase’.

The kit also looks for prominent crypto apps, comprising Uniswap and MetaMask, to have crypto or sensitive information.

Highlighted Crypto News Today:

UK Reform Party Races Ahead Through Crypto Donations

TagsGoogleiPhoneWallet

Trending Cryptos

ctr
CitreaCTR
wstusdt
wrapped stUSDTWSTUSDT
apr
aPrioriAPR
ctx
Cryptex FinanceCTX
audio
AudiusAUDIO
mantra
MantraMANTRA
waxl
AxelarWAXL
bill
Billions NetworkBILL
pyth
PYTH (Pyth)PYTH
rune
THORChainRUNE
velodrome
Velodrome FinanceVELODROME
brev
BrevisBREV
cake
PancakeSwapCAKE
jst
JUSTJST
band
Band ProtocolBAND

Related Questions

QWhat is the name of the exploit kit targeting iPhone users, as revealed by Google's Threat Intelligence Group?

AThe exploit kit is referred to as 'Coruna' by its developers.

QWhich iOS versions are vulnerable to the 'Coruna' exploit kit?

AThe kit targets iPhones running on iOS versions 13.0 up to 17.2.1.

QWhat is the primary goal of the 'Coruna' exploit kit?

AIts primary goal is to steal crypto wallet seed phrases and sensitive financial information from users.

QHow does the exploit kit initially fingerprint a user's device?

AIt uses JavaScript to fingerprint the device in order to deliver the correct exploit.

QWhat two pieces of advice did GTIG give to iPhone users to protect themselves from this threat?

AGTIG advised users to update their devices to the latest iOS version or, if that's not possible, to enable lockdown mode to help counter sophisticated attacks.

Related Reads

The Verdict in Choi Tae-won's Divorce Case: Revealing the Inheritance Undercurrent Behind SK Hynix's Trillion-Won Empire

SK Group Chairman Chey Tae-won's high-profile divorce case, involving a record 1.38 trillion won settlement, has drawn attention to the succession plans for Korea's second-largest conglomerate, especially its crown jewel, SK hynix. Unlike traditional chaebol scripts centered on the eldest son, Chey's three children from his marriage to former President Roh Tae-woo's daughter, Roh Soh-yeong, are carving distinct, non-traditional paths. Eldest daughter Chey Yun-jung (b. 1989) is seen as the most evident successor. With a scientific and consulting background, she holds executive roles at SK bioscience and SK Inc.'s growth support department, focusing on future strategy and biopharma. Her marriage is to an AI infrastructure entrepreneur, not a traditional business alliance. Second daughter Chey Min-jung (b. 1991) took a unique route, voluntarily serving as a South Korean naval officer, including an anti-piracy deployment. She later worked on policy and strategy for SK hynix in Washington D.C. before co-founding an AI-driven healthcare startup. She married a former U.S. Marine Corps officer, connecting her to U.S. defense and policy circles—networks crucial for a global semiconductor giant. The only son, Chey In-geun (b. 1995), who studied physics like his father, worked briefly at SK E&S before joining McKinsey. Despite fitting the traditional "heir" profile as the eldest son, he remains silent and holds no public position or shares in SK, suggesting the old succession playbook is obsolete. As SK hynix's valuation soars, becoming a geopolitical asset in the AI era, the heirs' legitimacy is no longer automatic. They must prove themselves in fields like AI biotech, global policy, and strategic consulting. Their marriages also reflect new elite networks in tech and defense, not old political alliances. Their inheritance is the complex challenge of navigating a globalized, tech-driven world, not just a corporate throne.

marsbit2 days ago 09:06

The Verdict in Choi Tae-won's Divorce Case: Revealing the Inheritance Undercurrent Behind SK Hynix's Trillion-Won Empire

marsbit2 days ago 09:06

Banks oppose stablecoin yield deal – Can CLARITY Act find 60 votes?

The Bank Policy Institute (BPI) has opposed the latest draft of the CLARITY Act, criticizing its provisions on stablecoin yield and illicit finance. The banking industry sought a total ban on stablecoin yield, but the bill's compromise only prohibits passive yield on idle balances. This opposition has influenced lawmakers, reducing tentative Republican Senate support to potentially 49 votes. With the 60-vote threshold needed, securing sufficient Democratic support appears difficult as some pro-crypto Democrats also oppose the bill due to ethics and illicit finance concerns. Senate Majority Leader John Thune expressed doubt the bill can pass before the August recess. Market odds for the bill's passage in 2026 have fallen, leaving its future uncertain.

ambcrypto2 days ago 09:02

Banks oppose stablecoin yield deal – Can CLARITY Act find 60 votes?

ambcrypto2 days ago 09:02

2 Months, Valuation Soars from $8.8B to $68B! The Largest AI Model Hub OpenRouter May Be Acquired

Stripe is reportedly in talks to acquire AI model marketplace OpenRouter for a price nearing $10 billion, a dramatic increase from its $1.3 billion valuation just two months prior. The deal, which could be announced within a month, would see the payment giant absorb a key "router" or aggregation layer in the AI infrastructure stack. OpenRouter provides developers with a single API to access over 400 large language models (LLMs), automatically routing queries to the most suitable model based on cost, capability, and speed. This allows AI applications to optimize expenses while maintaining user experience. Founded in 2023 by ex-OpenSea co-founder Alex Atallah and Louis Vichy, OpenRouter has grown rapidly, reaching $50 million in annualized revenue by April and serving over one million developers. For Stripe, the acquisition of OpenRouter follows its late-2025 purchase of usage-based billing platform Metronome. The combined strategy aims to create an integrated suite for the AI economy: OpenRouter would handle model selection and routing, Metronome would manage granular usage-based billing, and Stripe's core platform would process payments. This positions Stripe to control a critical part of the AI application value chain, influencing which models get used while simplifying cost management for enterprise customers.

链捕手2 days ago 08:59

2 Months, Valuation Soars from $8.8B to $68B! The Largest AI Model Hub OpenRouter May Be Acquired

链捕手2 days ago 08:59

From OpenSea to OpenRouter: Is Alex Atallah Repeating His 'Exit at the Peak' Playbook?

From OpenSea to OpenRouter: Is Alex Atallah Repeating His "Exit at the Peak" Playbook? According to the Wall Street Journal, payments giant Stripe is in talks to acquire the AI model aggregation platform OpenRouter in a potential deal valuing the company near $100 billion. This would mark founder Alex Atallah's second creation of a company reaching a $100 billion valuation, following his co-founding of NFT marketplace OpenSea. OpenRouter, founded just over three years ago, has grown rapidly by acting as a unified gateway for developers to access over 400 AI models. It currently has about 10 million users and processes over 200 trillion tokens monthly. While the platform's annualized revenue is around $50 million, its valuation has skyrocketed from $1.3 billion in March 2026. The potential acquisition by Stripe, a company OpenRouter's founder once likened it to, represents a major expansion into AI infrastructure for the payments leader. This move echoes Atallah's previous timing with OpenSea, where he departed before the NFT market's significant downturn. For OpenRouter, selling now may be strategic. Despite its scale, its business model—charging a 5-5.5% fee on AI inference calls—faces pressure from competition, open-source models, and potential price wars among model providers, limiting its profitability narrative for an IPO. A key asset for potential acquirers like Stripe is OpenRouter's vast repository of real-world AI usage data, which offers unique insights into model performance and developer preferences that are difficult to replicate. Whether this potential deal signifies a new valuation benchmark for AI infrastructure or another market peak signal remains to be seen.

链捕手2 days ago 08:42

From OpenSea to OpenRouter: Is Alex Atallah Repeating His 'Exit at the Peak' Playbook?

链捕手2 days ago 08:42

Pons V2 brings RWA trading pairs as Robinhood Chain broadens its ambitions

Pons, a key launchpad on Robinhood Chain, has launched its V2 upgrade. The update aims to boost liquidity, remove trading restrictions for most users via an ETH-denominated bonding curve, and introduces support for custom tokenized real-world asset (RWA) trading pairs. This aligns with Robinhood Chain's broader RWA focus. The upgrade also allows creators to collect fees in ETH by default. The network itself is growing rapidly, surpassing $300 million in Total Value Locked. Its cumulative DEX volume has exceeded $9 billion, with about 80% coming from speculative memecoin trading. However, data shows 63% of traders are at a loss, with profits concentrated in a small number of wallets. The introduction of RWAs could help drive more organic adoption for the chain, which is positioning itself as a major player for speculative trading, challenging networks like Base and Solana.

ambcrypto2 days ago 08:26

Pons V2 brings RWA trading pairs as Robinhood Chain broadens its ambitions

ambcrypto2 days ago 08:26

Trading

Spot

Hot Articles

Discussions

Welcome to the HTX Community. Here, you can stay informed about the latest platform developments and gain access to professional market insights. Users' opinions on the price of S (S) are presented below.

活动图片

Top Questions