New Attack on iPhones

Security experts at Google have discovered a new hacking tool designed to target iPhone users and steal cryptocurrency-related data. The exploit kit, called Coruna, is mainly used in phishing campaigns—scams that impersonate legitimate websites to trick victims.

The tool works on iPhones running iOS versions from 13.0 to 17.2.1. According to Google’s report, it includes five complete exploit chains and 23 different security vulnerabilities, some of which had not been publicly known before.

Researchers first encountered Coruna in February 2025. At the beginning, it was used in attacks targeting users in Ukraine. Later, similar mechanisms appeared on fake websites related to finance and cryptocurrencies.

The attack itself is relatively simple. A victim lands on a malicious website that looks like a legitimate cryptocurrency service. If the page is opened from an iPhone, a special script checks the device model and iOS version, then launches the appropriate exploit.

Once it gains partial control over the system, the tool begins searching for financial information. It can scan text messages for phrases such as “seed phrase” or “backup phrase.” These are key words used to recover cryptocurrency wallets. The exploit also checks whether popular crypto apps—such as Uniswap or MetaMask—are installed on the phone.

Google emphasizes that Coruna does not work on the latest version of iOS. For this reason, the company strongly recommends that iPhone users keep their devices updated. If someone cannot update their phone, Apple suggests enabling Lockdown Mode, which restricts certain features and makes advanced attacks more difficult.

It is still unclear who created the tool. The company iVerify believes such sophisticated software could have cost millions of dollars to develop and might be connected to tools used by the U.S. government. However, a researcher from Kaspersky says current reports do not provide evidence to confirm such links.