Google Warns of “Coruna” iPhone Exploit That Could Drain Crypto Wallets

A sophisticated exploit kit named Coruna has been identified, posing a significant risk to users of older iPhones, particularly those holding cryptocurrency. Security researchers from the Google Threat Intelligence Group revealed that this exploit targets devices running outdated versions of iOS, potentially stealing sensitive crypto wallet data, including recovery phrases.

How Coruna Operates

Coruna is a complex attack that combines at least 23 vulnerabilities and five full exploit chains, enabling it to compromise iPhones running iOS versions between 13 and 17.2.1. The attack typically initiates when a user visits a malicious website. Hidden JavaScript then scans the device to identify its model, operating system version, and security settings. If a vulnerable device is detected, Coruna bypasses Apple's security measures, escalates privileges, and installs spyware to extract sensitive information.

Targeting Crypto Wallets

The primary objective of the Coruna malware is to locate and steal encrypted wallet files, login credentials, and mnemonic recovery phrases. Access to these recovery phrases allows attackers to instantly restore a victim's crypto wallet on another device and transfer all digital assets, such as Bitcoin and Ethereum. The exploit is distributed through "watering hole" attacks, where hackers compromise websites frequently visited by crypto users, including fake trading platforms and phishing sites.

Potential Nation-State Origins and Criminal Use

Analysis by security firm iVerify suggests that parts of Coruna's code bear resemblance to tools associated with U.S. government cyber programs. However, it is believed that the toolkit may have been leaked and is now being utilized by cybercriminal groups and intelligence actors from countries like Russia and China. This could represent the first large-scale mobile exploit campaign leveraging tools derived from nation-state capabilities.

Protective Measures for Crypto Users

Fortunately, Coruna has limitations: it does not function on devices running the latest iOS versions, is rendered ineffective by Apple's Lockdown Mode, and does not operate in private browsing mode. To safeguard crypto assets, users are strongly advised to:

• •
  Keep their iPhone updated to the latest iOS version.
• •
  Avoid visiting unknown crypto platforms or suspicious websites.
• •
  Enable Lockdown Mode, especially when managing significant crypto holdings.
• •
  Store recovery phrases offline, avoiding phone notes or screenshots.

Experts emphasize that maintaining up-to-date software on devices is now a critical security measure for crypto investors, potentially more so than market timing, given the speed at which a successful exploit can lead to total loss of funds.