iPhone Exploit ’Coruna’ Targets Crypto Wallets in Sophisticated Cyberattack
A state-sponsored iPhone hacking toolkit dubbed Coruna has been weaponized against cryptocurrency users, leveraging five exploit chains and 23 iOS vulnerabilities to steal seed phrases and financial data. First identified by Google's Threat Intelligence Group in February 2025, the malware initially functioned as surveillanceware before migrating to fake crypto portals that harvest wallet credentials from devices running iOS 13.0 through 17.2.1.
Apple has patched the vulnerabilities in subsequent releases, but the incident underscores growing convergence between cyber-espionage tools and financial crime. Lockdown Mode and immediate iOS updates are recommended countermeasures for high-risk users.