report<\/a> from Google\u2019s Threat Intelligence Group, the exploit framework, dubbed \u201cCoruna,\u201d contains five full iOS exploit chains and 23 vulnerabilities capable of compromising iPhones running operating systems between iOS 13 and iOS 17.2.1.<\/p>\nThe exploit kit allows attackers to execute malicious code through web content by exploiting vulnerabilities in Apple\u2019s WebKit browser engine and other components. Once a victim visits a compromised website, the framework fingerprints the device to identify the exact iPhone model and software version before deploying the most effective exploit chain.<\/p>\n
<\/p>\n
Researchers say the malware can then deliver additional payloads designed to harvest sensitive data from the device, including cryptocurrency wallet information.<\/p>\n
In some campaigns, the exploit kit was deployed through fake gambling and cryptocurrency websites that specifically targeted iPhone users. <\/p>\n
The malicious payload was capable of scanning images and files on the device for keywords such as \u201cbackup phrase\u201d or \u201cbank account,\u201d allowing attackers to extract recovery phrases and access crypto wallets.<\/p>\n
Google\u2019s investigation shows the exploit kit circulated among several threat actors over the past year. It was first observed in 2025 in surveillance operations, later used in watering-hole attacks against Ukrainian users by a suspected Russian espionage group, and eventually adopted by financially motivated hackers linked to China.<\/p>\n
Security analysts say the case highlights a worrying trend where sophisticated spyware-grade exploits migrate from government or commercial surveillance tools into the broader cybercrime ecosystem.<\/p>\n
Researchers recommend updating devices to the latest iOS versions, as the exploit kit does not affect the newest software releases.<\/p>\n
The findings underscore the growing intersection between mobile security threats and cryptocurrency theft, with attackers increasingly targeting digital wallets stored on smartphones.<\/p>\n
<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"
Cybersecurity researchers are warning that a powerful iPhone exploit kit is increasingly being used in cybercrime campaigns targeting cryptocurrency users. Summary Google researchers identified a powerful iOS exploit kit called…<\/p>\n","protected":false},"author":1,"featured_media":23244,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-23243","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cryptocurrency"],"_links":{"self":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/23243","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/comments?post=23243"}],"version-history":[{"count":1,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/23243\/revisions"}],"predecessor-version":[{"id":23245,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/23243\/revisions\/23245"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/media\/23244"}],"wp:attachment":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/media?parent=23243"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/categories?post=23243"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/tags?post=23243"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}