Google Uncovers iPhone Exploit Kit Targeting Crypto Wallets

TheNewsCryptoОпубликовано 2026-03-05Обновлено 2026-03-05

Введение

Google's Threat Intelligence Group (GTIG) has uncovered a sophisticated iOS exploit kit, dubbed 'Coruna,' targeting iPhone users on iOS versions 13.0 to 17.2.1. The kit, which contains five complete exploit chains and approximately 23 exploits—including previously unknown ones—aims to steal cryptocurrency wallet seed phrases and sensitive financial data. First identified in February 2025, the kit has been linked to a suspected Russian espionage group targeting Ukrainians and later to fake Chinese crypto websites impersonating platforms like WEEX. When users visit these sites on vulnerable iOS devices, the kit deploys to harvest financial information, including seed phrases and credentials from apps like MetaMask and Uniswap. GTIG advises users to update to the latest iOS version or enable Lockdown Mode to mitigate such attacks.

Google’s threat researchers reveal that they have unveiled a new exploit kit aiming at Apple iPhone users, targeted at stealing crypto wallet seed phrases. The kit, referred to as ‘Coruna’ by its developers, aims at iPhones working on iOS versions 13.0 up to 17.2.1.

It contains five complete iOS exploit chains and around 23 exploits, comprising ones that were so far unknown to the public, the Google Threat Intelligence Group (GTIG) mentioned in a report on March 4.

The group revealed that it first found the kit in February 2025 and has since traced its applications by a suspected Russian espionage group against Ukrainians and then to fake Chinese crypto websites that target the theft of crypto.

GTIG further mentioned that the kit does not run with the latest version of iOS and requested iPhone users update their devices to the latest software version. If that is not possible, users should put the phone in lockdown mode, which, according to Apple, can help in countering sophisticated attacks.

What Does GTIG Further Mention?

GTIG mentioned that it came across parts of an iOS exploit in February last year in which a consumer of a surveillance company used JavaScript to fingerprint the device to offer the correct exploit.

Further, in the same year, it found the same JavaScript framework concealed on various compromised Ukrainian websites that was solely delivered to selected iPhone users from a particular geolocation.

GTIG mentioned that it found the similar substructure in December on a very big set of fake Chinese websites often associated with finance, comprising one that spoofed the crypto exchange WEEX.

When a user has access to the website with an iOS device, the substructure gives the exploit kit and hunts for financial information, comprising analysing texts having seed phrases and keywords like ‘backup phrase’.

The kit also looks for prominent crypto apps, comprising Uniswap and MetaMask, to have crypto or sensitive information.

Highlighted Crypto News Today:

UK Reform Party Races Ahead Through Crypto Donations

Связанные с этим вопросы

QWhat is the name of the exploit kit targeting iPhone users, as revealed by Google's Threat Intelligence Group?

AThe exploit kit is referred to as 'Coruna' by its developers.

QWhich iOS versions are vulnerable to the 'Coruna' exploit kit?

AThe kit targets iPhones running on iOS versions 13.0 up to 17.2.1.

QWhat is the primary goal of the 'Coruna' exploit kit?

AIts primary goal is to steal crypto wallet seed phrases and sensitive financial information from users.

QHow does the exploit kit initially fingerprint a user's device?

AIt uses JavaScript to fingerprint the device in order to deliver the correct exploit.

QWhat two pieces of advice did GTIG give to iPhone users to protect themselves from this threat?

AGTIG advised users to update their devices to the latest iOS version or, if that's not possible, to enable lockdown mode to help counter sophisticated attacks.

Похожее

Data Inflation, Is ETH's Fundamental Still There?

The report by Culper Research argues that Ethereum's fundamentals have been severely damaged following the December 2025 Fusaka upgrade. The upgrade increased the gas limit, causing a 90% drop in gas fees—far more than the 10-30% predicted—and led to a surplus of cheap block space. This has enabled a surge in "address poisoning" or "dusting" attacks, which now account for 95% of new wallet creation and over 22.5% of all ETH transactions. The authors claim these attacks artificially inflate on-chain activity metrics, such as active addresses and transaction volume, which are mistakenly cited by bulls like Tom Lee as evidence of organic growth. Additionally, the report states that lower transaction fees have reduced validator earnings, weakening staking incentives and undermining Ethereum’s token economics. It highlights that Vitalik Buterin has been selling significant amounts of ETH, suggesting insider awareness of these issues. The authors also note competitive threats from Solana, which is gaining developer momentum and institutional adoption. Culper Research concludes that Ethereum’s economic model is broken and maintains a bearish outlook on ETH.

比推20 мин. назад

Data Inflation, Is ETH's Fundamental Still There?

比推20 мин. назад

$15.19M LINK transfer coincides with channel break – Will $9.60 fall next?

A wallet associated with FlowDesk transferred 1.61M LINK ($15.19M) to Binance, raising concerns about near-term selling pressure. This occurred as LINK stabilized after breaking out of a long-term descending channel, now consolidating between key support at $7.95 and resistance at $9.60. Technical indicators like the RSI show improving strength, hovering above 50, suggesting reduced bearish momentum. Despite the large inflow, derivatives data reveals a strong bullish bias among top traders, with a 3.01 long-to-short ratio. However, a significant liquidation cluster near $9 poses a downside risk, potentially triggering a brief sell-off. If buyers defend $7.95 and reclaim $9.60, a move toward $12 resistance becomes possible.

ambcrypto40 мин. назад

$15.19M LINK transfer coincides with channel break – Will $9.60 fall next?

ambcrypto40 мин. назад

Cardano Payments Roll Out Across 137 SPAR Stores In Switzerland

The Cardano blockchain has been integrated into the Swiss financial platform DFX.swiss, enabling its native token ADA to be used for retail payments. As a result, customers can now pay with ADA at 137 SPAR stores across Switzerland through the Open Crypto Pay standard. This integration allows direct payments from native wallets and reduces transaction fees by about two-thirds compared to traditional payment methods. Additionally, DFX.swiss provides a bridge to traditional banking, allowing users to exchange ADA for fiat currencies. Despite this development, ADA’s underperformed recently, declining over 6% in a week as large investors reduced their holdings.

bitcoinist46 мин. назад

Cardano Payments Roll Out Across 137 SPAR Stores In Switzerland

bitcoinist46 мин. назад

Internet Computer (ICP) Rebounds 6%: More Upside Ahead or Just a Short-Term Spike?

Amid a bearish and fearful cryptocurrency market, Internet Computer (ICP) has rebounded with a 6.2% gain, reaching a high of $2.70 after trading as low as $2.33. It currently trades at $2.56 with a 24-hour trading volume of $124.33 million. Technical indicators suggest potential for further upside, with the MACD above the signal line and the Chaikin Money Flow at 0.13 indicating stronger buying pressure and accumulation. However, the RSI at 72.35 signals the asset is in the overbought zone, suggesting a possibility of short-term consolidation. Key resistance lies at $2.67-$2.78, while support levels are at $2.45 and $2.34.

TheNewsCrypto47 мин. назад

Internet Computer (ICP) Rebounds 6%: More Upside Ahead or Just a Short-Term Spike?

TheNewsCrypto47 мин. назад

Notcoin (NOT) at a Crossroads: Will the Price Rebound or Extend the Downside Risk?

Notcoin (NOT) is facing a critical juncture after a 3.5% price drop in the last 24 hours, trading around $0.0003737. Key technical indicators suggest a potential for either a rebound or further decline. The MACD shows early bullish signs but remains near neutral, while the Chaikin Money Flow (CMF) at 0.20 indicates strong buying pressure and capital inflows. The RSI at 51.30 reflects a neutral to slightly-bullish momentum, and the Bull Bear Power (BBP) suggests a balanced market with no clear dominance. If bullish momentum continues, NOT could test resistance at $0.0003759, potentially reaching $0.0003781. However, if bearish pressure returns, the price may fall to support at $0.0003715 or even lower.

TheNewsCrypto1 ч. назад

Notcoin (NOT) at a Crossroads: Will the Price Rebound or Extend the Downside Risk?

TheNewsCrypto1 ч. назад

Торговля

Спот

Фьючерсы

Популярные статьи

Как купить S

Добро пожаловать на HTX.com! Мы сделали приобретение Sonic (S) простым и удобным. Следуйте нашему пошаговому руководству и отправляйтесь в свое крипто-путешествие.Шаг 1: Создайте аккаунт на HTXИспользуйте свой адрес электронной почты или номер телефона, чтобы зарегистрироваться и бесплатно создать аккаунт на HTX. Пройдите удобную регистрацию и откройте для себя весь функционал.Создать аккаунтШаг 2: Перейдите в Купить криптовалюту и выберите свой способ оплатыКредитная/Дебетовая Карта: Используйте свою карту Visa или Mastercard для мгновенной покупки Sonic (S).Баланс: Используйте средства с баланса вашего аккаунта HTX для простой торговли.Третьи Лица: Мы добавили популярные способы оплаты, такие как Google Pay и Apple Pay, для повышения удобства.P2P: Торгуйте напрямую с другими пользователями на HTX.Внебиржевая Торговля (OTC): Мы предлагаем индивидуальные услуги и конкурентоспособные обменные курсы для трейдеров.Шаг 3: Хранение Sonic (S)После приобретения вами Sonic (S) храните их в своем аккаунте на HTX. В качестве альтернативы вы можете отправить их куда-либо с помощью перевода в блокчейне или использовать для торговли с другими криптовалютами.Шаг 4: Торговля Sonic (S)С легкостью торгуйте Sonic (S) на спотовом рынке HTX. Просто зайдите в свой аккаунт, выберите торговую пару, совершайте сделки и следите за ними в режиме реального времени. Мы предлагаем удобный интерфейс как для начинающих, так и для опытных трейдеров.

781 просмотров всегоОпубликовано 2025.01.15Обновлено 2025.03.21

Sonic: Обновления под руководством Андре Кронье – новая звезда Layer-1 на фоне спада рынка

Он решает проблемы масштабируемости, совместимости между блокчейнами и стимулов для разработчиков с помощью технологических инноваций.

2.1k просмотров всегоОпубликовано 2025.04.09Обновлено 2025.04.09

Sonic: Обновления под руководством Андре Кронье – новая звезда Layer-1 на фоне спада рынка

HTX Learn: Пройдите обучение по "Sonic" и разделите 1000 USDT

HTX Learn — ваш проводник в мир перспективных проектов, и мы запускаем специальное мероприятие "Учитесь и Зарабатывайте", посвящённое этим проектам. Наше новое направление .

1.6k просмотров всегоОпубликовано 2025.04.10Обновлено 2025.04.10

HTX Learn: Пройдите обучение по "Sonic" и разделите 1000 USDT

Обсуждения

Добро пожаловать в Сообщество HTX. Здесь вы сможете быть в курсе последних новостей о развитии платформы и получить доступ к профессиональной аналитической информации о рынке. Мнения пользователей о цене на S (S) представлены ниже.