iPhone Users Advised: Beware of Crypto Scams Linked to 'Coruna' iOS Exploits

Google’s Threat Intelligence Group (GTIG) has issued a warning about a "new and powerful" exploit kit for iOS, named Coruna, which the developers have launched on fraudulent finance and crypto websites. These sites aim to attract iPhone users, leading them to pages that can silently deploy harmful exploits. The findings from GTIG indicate that these campaigns are primarily focused on stealing seed phrases and wallet information from popular mobile applications.

Key Takeaways:

A new iOS exploit kit named Coruna is targeting iPhone users through counterfeit finance and crypto websites.
Coruna exploits Apple devices running iOS 13.0 to 17.2.1, containing many exploits focused on stealing wallet information.
Users should update their iOS version to mitigate risk or enable Apple's Lockdown Mode for added security.
Many crypto wallet applications are at risk, making it vital for crypto users to stay informed and cautious online.

Coruna predominantly affects Apple devices running iOS versions 13.0 through 17.2.1, comprising five complete exploit chains and 23 specific exploits. GTIG tracked the evolution of this kit throughout 2025, noting its initial use by a client of a commercial surveillance firm, progressing to "watering hole" assaults on compromised Ukrainian websites, and eventually broad distribution through Chinese-language scam sites linked to a financially motivated group identified as UNC6691.

Understanding the Crypto Scam Targeting iPhones

During the scam's execution phase, GTIG reported observing the JavaScript framework of Coruna being used on a vast number of fake Chinese websites primarily focused on finance. A notable example provided by GTIG is a counterfeit WEEX-branded crypto exchange that directed users to iOS devices. Once there, a concealed iFrame was injected, enabling the exploit kit to be activated irrespective of the users' geographical location.

This method of delivery is crucial as it merges traditional phishing tactics with direct device exploitation. According to GTIG, merely visiting the malicious page on a susceptible iPhone is sufficient to trigger the sequence. The framework fingerprints the device to determine its model and iOS version, subsequently loading the appropriate WebKit remote code execution (RCE) exploit along with a pointer authentication code (PAC) bypass.

One specific WebKit RCE linked to CVE-2024-23222 was addressed by Apple in iOS 17.3 on January 22, 2024.

At the end of the exploit sequence, GTIG indicates that Coruna installs a stager known as PlasmaLoader (tracked as PLASMAGRID). This component is primarily focused on stealing financial information rather than traditional surveillance features. GTIG notes that the payload can decode QR codes from images saved on the device and search for text strings containing BIP39 word sequences, as well as keywords like “backup phrase” and “bank account,” including those within Apple Notes, to exfiltrate this sensitive information.

Moreover, the payload is modular, meaning that it can download and execute additional modules remotely. Many of these identified modules are crafted to intercept functions and steal sensitive data from popular cryptocurrency wallet apps, including MetaMask, Trust Wallet, Uniswap’s wallet, Phantom, Exodus, and wallets from the TON ecosystem like Tonkeeper.

Mobile security firm iVerify also highlighted similar concerns around the same time as GTIG's report, pointing to a continual threat to mobile devices.

Steps Crypto Users Should Take Now

Google has stated that Coruna "is not effective against the latest version of iOS" and recommends that users perform an update. If updating is not an option, GTIG advises enabling Apple’s Lockdown Mode for heightened security. Additionally, GTIG has added the identified domains and websites to Google Safe Browsing to help minimize further exposure.

For those deeply involved in cryptocurrency, the key takeaway is practical: mobile wallets are at a crucial intersection of high-value assets and frequent web traffic, making them particularly vulnerable to “visit-to-compromise” schemes. The report from GTIG indicates that these scams aim not just to connect wallets but to ensure victims are on the correct device with an appropriate iOS version, thus facilitating exploitation.

As of the time of this report, the total market capitalization of cryptocurrency stands at $2.45 trillion.

Total crypto market cap faces the 0.786 Fib, 1-week chart | Source: TOTAL on TradingView.com