Google warns of Coruna iPhone exploit kit targeting crypto wallets

Google's Threat Intelligence Group uncovered a new iPhone exploit kit called "Coruna" that targets devices running iOS 13.0 through 17.2.1. The toolkit contains five full iOS exploit chains and a total of 23 exploits, including some that were previously unknown.

GTIG first discovered Coruna in February 2025 and has tracked its use by a suspected Russian espionage group against Ukrainians and later on fake Chinese crypto websites designed to steal crypto. GTIG said the kit does not work with the latest version of iOS and urged users to update; if that is not possible, users should enable Lockdown Mode, which Apple says can counter sophisticated attacks.

The group found parts of an iOS exploit in February 2025 in which a customer of a surveillance company used JavaScript to fingerprint devices and deliver the appropriate exploit. Later that year the same JavaScript framework appeared on multiple compromised Ukrainian websites and was delivered only to selected iPhone users from a specific geolocation.

Ukraine

coruna, iphone exploit, ios 13, ios 17.2.1, google, gtig, crypto wallets, russian espionage, lockdown mode, javascript fingerprinting