{"id":37362,"date":"2026-03-05T18:00:41","date_gmt":"2026-03-05T18:00:41","guid":{"rendered":"https:\/\/cryptomag.finance\/?p=37362"},"modified":"2026-03-05T18:00:41","modified_gmt":"2026-03-05T18:00:41","slug":"iphone-users-warned-crypto-scams-can-trigger-coruna-ios-exploits","status":"publish","type":"post","link":"https:\/\/cryptomag.finance\/?p=37362","title":{"rendered":"iPhone Users Warned: Crypto Scams Can Trigger \u2018Coruna\u2019 iOS Exploits"},"content":{"rendered":"

Google\u2019s Threat Intelligence Group (GTIG) is warning that a \u201cnew and powerful\u201d iOS exploit kit, dubbed Coruna by its developers has been deployed on fake finance and crypto websites designed to lure iPhone users into visiting pages that can silently deliver exploits. For crypto holders, the risk is blunt: GTIG\u2019s analysis shows<\/a> the campaigns ultimately focused on harvesting seed phrases and wallet data from popular mobile apps.<\/p>\n

Coruna targets Apple devices running iOS 13.0 through iOS 17.2.1, bundling five full exploit chains and 23 exploits. GTIG says it recovered the kit after tracking its evolution across 2025, from early use by a customer of a commercial surveillance company, to \u201cwatering hole\u201d attacks on compromised Ukrainian websites, and finally to broad-scale distribution via Chinese-language scam sites<\/a> tied to a financially motivated actor it tracks as UNC6691.<\/p>\n

A Crypto Lure Designed For iPhones<\/h2>\n

In the scam-wave phase, GTIG says it observed the JavaScript framework behind Coruna deployed across a \u201cvery large set\u201d of fake Chinese websites largely themed around finance. One example cited by GTIG is a fake WEEX-branded crypto exchange page that tried to push visitors onto an iOS device\u2014after which a hidden iFrame would be injected to deliver the exploit kit \u201cregardless of their geolocation.\u201d<\/p>\n

The delivery mechanics matter because they blur the line between traditional phishing and outright device compromise: in GTIG\u2019s telling, simply arriving on the booby-trapped page from a vulnerable iPhone was enough to begin the chain. The framework fingerprints the device to identify model and iOS version, then loads the appropriate WebKit remote code execution exploit and a pointer authentication (PAC) bypass.<\/p>\n

GTIG tied one WebKit RCE it recovered to CVE-2024-23222, noting it was addressed by Apple in iOS 17.3 on Jan. 22, 2024.<\/p>\n

At the end of the chain, GTIG says Coruna drops a stager it calls PlasmaLoader (tracked as PLASMAGRID) and describes it as focused less on classic surveillance features and more on stealing financial information. According to GTIG, the payload can decode QR codes from images stored on the device and scan text blobs for BIP39 word sequences, along with keywords such as \u201cbackup phrase\u201d and \u201cbank account\u201d, including in Apple Memos, which it can then exfiltrate.<\/p>\n

The payload is also modular. GTIG says it can pull down and run additional modules remotely, and that many of the identified modules are designed to hook functions and exfiltrate sensitive information from common crypto wallet apps\u2014among them MetaMask<\/a>, Trust Wallet, Uniswap\u2019s wallet, Phantom, Exodus, and TON ecosystem wallets such as Tonkeeper.<\/p>\n

The broader arc was also flagged by mobile security firm iVerify, which published its own findings around the same time as GTIG\u2019s report. \u201cAnd that\u2019s exactly what happened again here, but on mobile devices. Phone OEMs do as good a job as anyone can do\u2026\u201d<\/p>\n

What Crypto Users Can Do Now<\/h2>\n

Google says Coruna \u201cis not effective against the latest version of iOS,\u201d and urges users to update. If updating isn\u2019t possible, GTIG recommends enabling Apple\u2019s Lockdown Mode. GTIG also says it added the identified websites and domains to Google Safe Browsing to help reduce further exposure.<\/p>\n

For crypto-native users, the immediate takeaway is practical: mobile wallets sit at the intersection of high-value assets and high-frequency web traffic, which makes \u201cvisit-to-compromise\u201d campaigns uniquely dangerous. GTIG\u2019s reporting suggests the scam funnel wasn\u2019t just about getting victims to connect wallets, it was about getting them onto the right device, on the right iOS version, so exploitation could do the rest.<\/p>\n

At press time, the total crypto market cap stood at $2.45 trillion.<\/p>\n

\"Total<\/p>","protected":false},"excerpt":{"rendered":"

Google\u2019s Threat Intelligence Group (GTIG) is warning that a \u201cnew and powerful\u201d iOS exploit kit, dubbed Coruna by its developers has been deployed on fake finance and crypto websites designed to lure iPhone users into visiting pages that can silently deliver exploits. For crypto holders, the risk is blunt: GTIG\u2019s analysis shows the campaigns ultimately […]<\/p>\n","protected":false},"author":1,"featured_media":37363,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"footnotes":""},"categories":[],"tags":[],"class_list":["post-37362","post","type-post","status-publish","format-standard","has-post-thumbnail"],"yoast_head":"\niPhone Users Warned: Crypto Scams Can Trigger \u2018Coruna\u2019 iOS Exploits - Cryptomag<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptomag.finance\/?p=37362\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"iPhone Users Warned: Crypto Scams Can Trigger \u2018Coruna\u2019 iOS Exploits - Cryptomag\" \/>\n<meta property=\"og:description\" content=\"Google\u2019s Threat Intelligence Group (GTIG) is warning that a \u201cnew and powerful\u201d iOS exploit kit, dubbed Coruna by its developers has been deployed on fake finance and crypto websites designed to lure iPhone users into visiting pages that can silently deliver exploits. For crypto holders, the risk is blunt: GTIG\u2019s analysis shows the campaigns ultimately […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptomag.finance\/?p=37362\" \/>\n<meta property=\"og:site_name\" content=\"Cryptomag\" \/>\n<meta property=\"article:published_time\" content=\"2026-03-05T18:00:41+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptomag.finance\/wp-content\/uploads\/2025\/06\/generic-crypto-image.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"560\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Crypto Magazine\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@cryptomagz\" \/>\n<meta name=\"twitter:site\" content=\"@cryptomagz\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Crypto Magazine\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=37362#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=37362\"},\"author\":{\"name\":\"Crypto Magazine\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\"},\"headline\":\"iPhone Users Warned: Crypto Scams Can Trigger \u2018Coruna\u2019 iOS Exploits\",\"datePublished\":\"2026-03-05T18:00:41+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=37362\"},\"wordCount\":601,\"image\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=37362#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/ChatGPT-Image-Mar-5-2026-10_30_56-AM-2RnM1l.png\",\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=37362\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/?p=37362\",\"name\":\"iPhone Users Warned: Crypto Scams Can Trigger \u2018Coruna\u2019 iOS Exploits - Cryptomag\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=37362#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=37362#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/ChatGPT-Image-Mar-5-2026-10_30_56-AM-2RnM1l.png\",\"datePublished\":\"2026-03-05T18:00:41+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=37362#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/cryptomag.finance\\\/?p=37362\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=37362#primaryimage\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/ChatGPT-Image-Mar-5-2026-10_30_56-AM-2RnM1l.png\",\"contentUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/ChatGPT-Image-Mar-5-2026-10_30_56-AM-2RnM1l.png\",\"width\":750,\"height\":500},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=37362#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/cryptomag.finance\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"iPhone Users Warned: Crypto Scams Can Trigger \u2018Coruna\u2019 iOS Exploits\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#website\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/\",\"name\":\"Cryptomag\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/cryptomag.finance\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\",\"name\":\"Crypto Magazine\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"caption\":\"Crypto Magazine\"},\"sameAs\":[\"https:\\\/\\\/cryptomag.finance\",\"https:\\\/\\\/x.com\\\/cryptomagz\"],\"url\":\"https:\\\/\\\/cryptomag.finance\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"iPhone Users Warned: Crypto Scams Can Trigger \u2018Coruna\u2019 iOS Exploits - Cryptomag","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptomag.finance\/?p=37362","og_locale":"en_US","og_type":"article","og_title":"iPhone Users Warned: Crypto Scams Can Trigger \u2018Coruna\u2019 iOS Exploits - Cryptomag","og_description":"Google\u2019s Threat Intelligence Group (GTIG) is warning that a \u201cnew and powerful\u201d iOS exploit kit, dubbed Coruna by its developers has been deployed on fake finance and crypto websites designed to lure iPhone users into visiting pages that can silently deliver exploits. For crypto holders, the risk is blunt: GTIG\u2019s analysis shows the campaigns ultimately […]","og_url":"https:\/\/cryptomag.finance\/?p=37362","og_site_name":"Cryptomag","article_published_time":"2026-03-05T18:00:41+00:00","og_image":[{"width":1000,"height":560,"url":"https:\/\/cryptomag.finance\/wp-content\/uploads\/2025\/06\/generic-crypto-image.webp","type":"image\/webp"}],"author":"Crypto Magazine","twitter_card":"summary_large_image","twitter_creator":"@cryptomagz","twitter_site":"@cryptomagz","twitter_misc":{"Written by":"Crypto Magazine","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/cryptomag.finance\/?p=37362#article","isPartOf":{"@id":"https:\/\/cryptomag.finance\/?p=37362"},"author":{"name":"Crypto Magazine","@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040"},"headline":"iPhone Users Warned: Crypto Scams Can Trigger \u2018Coruna\u2019 iOS Exploits","datePublished":"2026-03-05T18:00:41+00:00","mainEntityOfPage":{"@id":"https:\/\/cryptomag.finance\/?p=37362"},"wordCount":601,"image":{"@id":"https:\/\/cryptomag.finance\/?p=37362#primaryimage"},"thumbnailUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/ChatGPT-Image-Mar-5-2026-10_30_56-AM-2RnM1l.png","inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/cryptomag.finance\/?p=37362","url":"https:\/\/cryptomag.finance\/?p=37362","name":"iPhone Users Warned: Crypto Scams Can Trigger \u2018Coruna\u2019 iOS Exploits - Cryptomag","isPartOf":{"@id":"https:\/\/cryptomag.finance\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptomag.finance\/?p=37362#primaryimage"},"image":{"@id":"https:\/\/cryptomag.finance\/?p=37362#primaryimage"},"thumbnailUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/ChatGPT-Image-Mar-5-2026-10_30_56-AM-2RnM1l.png","datePublished":"2026-03-05T18:00:41+00:00","author":{"@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040"},"breadcrumb":{"@id":"https:\/\/cryptomag.finance\/?p=37362#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptomag.finance\/?p=37362"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptomag.finance\/?p=37362#primaryimage","url":"https:\/\/cryptomag.finance\/wp-content\/uploads\/ChatGPT-Image-Mar-5-2026-10_30_56-AM-2RnM1l.png","contentUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/ChatGPT-Image-Mar-5-2026-10_30_56-AM-2RnM1l.png","width":750,"height":500},{"@type":"BreadcrumbList","@id":"https:\/\/cryptomag.finance\/?p=37362#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptomag.finance\/"},{"@type":"ListItem","position":2,"name":"iPhone Users Warned: Crypto Scams Can Trigger \u2018Coruna\u2019 iOS Exploits"}]},{"@type":"WebSite","@id":"https:\/\/cryptomag.finance\/#website","url":"https:\/\/cryptomag.finance\/","name":"Cryptomag","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptomag.finance\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040","name":"Crypto Magazine","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","caption":"Crypto Magazine"},"sameAs":["https:\/\/cryptomag.finance","https:\/\/x.com\/cryptomagz"],"url":"https:\/\/cryptomag.finance\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts\/37362","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=37362"}],"version-history":[{"count":0,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts\/37362\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/media\/37363"}],"wp:attachment":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=37362"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=37362"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=37362"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}