March 5 News: Google Threat Intelligence Group (GTIG) recently released a security report stating that researchers have discovered a new iPhone exploit toolkit called “Coruna,” used to steal cryptocurrency wallet mnemonics and financial information. The toolkit targets devices running iOS 13.0 to 17.2.1 and launches targeted attacks through multiple exploit chains, drawing significant attention in the mobile security field.
The report shows that “Coruna” contains five complete iOS exploit chains, involving a total of 23 security vulnerabilities, some of which have never been publicly disclosed before. Google researchers said they first identified related attack activity in February 2025 and found that the tool was initially suspected to be used by Russian espionage groups for cyberattacks against Ukrainian users. It was later used to impersonate financial and crypto-related websites to trick users into revealing information.
The attack mainly relies on malicious web pages delivering exploit code. When iPhone users visit specific sites, JavaScript frameworks on the pages perform device fingerprinting, verify the system version, and then load the corresponding exploit chain. Researchers found the same framework on multiple compromised Ukrainian websites and noted that the attack code was only sent to iPhones in certain regions.
In December 2025, the team further detected the same framework on numerous fake Chinese-language websites related to financial services, including counterfeit crypto platform pages. Once victims access these sites on iOS devices, the tools scan for sensitive information such as mnemonic phrases, backup words, or bank account details, and attempt to read data from common crypto wallet apps to gain control of digital assets.
Google states that this exploit toolkit currently cannot run on the latest iOS versions, and recommends iPhone users upgrade their systems promptly. If upgrading is not possible, users can enable Apple’s “Lockdown Mode” to defend against complex network attacks.
Meanwhile, discussions about the origin of “Coruna” have also sparked controversy. Rocky Cole, co-founder of mobile security firm iVerify, told media that the tool is highly complex, with development costs possibly reaching millions of dollars, and shares some modules similar to those used in U.S. government cyber tools. However, Kaspersky security experts said there is currently not enough evidence to directly link its code to any known tools.
Security experts warn that cryptocurrency users should be vigilant against phishing pages and update their devices promptly when using mobile wallets or visiting related websites to reduce the risk of mnemonic leaks and digital asset theft.
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
Sui DeFi lending protocol Scallop is hacked, with a vulnerability in the old contract leading to 150k SUI stolen
Scallop was attacked on the Sui chain, and the side contract involved led to the sSUI rewards pool being exploited. Approximately 150k SUI were stolen. The core contract is secure, and deposits and withdrawals have been restored. The official statement applies only to the deprecated rewards contract; users’ funds were not affected. Former NEAR developer Vadim said the vulnerability originated from an outdated V2 package from 17 months ago, where not initializing last_index caused rewards to accumulate starting in 2023. The fix requires adding a version field to the shared object and strengthening version checks to prevent risks caused by outdated packages.
ChainNewsAbmedia4m ago
Scallop Discovers sSUI Reward Pool Vulnerability, Suffers 150K SUI Loss but Pledges Full Reimbursement
Gate News message, April 26 — Scallop, a lending protocol in the Sui ecosystem, announced the discovery of a vulnerability in an auxiliary contract associated with its sSUI reward pool, resulting in a loss of approximately 150,000 SUI. The affected contract has been frozen, and Scallop confirmed
GateNews4h ago
Litecoin Undergoes Deep Chain Reorganization After MWEB Privacy Layer Zero-Day Exploit
Gate News message, April 26 — Litecoin experienced a deep chain reorganization on Saturday (April 26) after attackers exploited a zero-day vulnerability in its MimbleWimble Extension Block (MWEB) privacy layer, according to the Litecoin Foundation. The reorg spanned blocks 3,095,930 to 3,095,943 and
GateNews5h ago
Litecoin Sees First Privacy Layer Hack: MWEB Zero-Day Vulnerability Triggered 13-Block Reorganization
According to The Block, the Litecoin Foundation confirmed that the MWEB privacy layer suffered a zero-day vulnerability. The attacker used older nodes to make forged MWEB transactions appear valid, causing a rollback of 13 blocks on the main chain (about 3 hours), and performing double-spends against cross-chain exchanges; NEAR Intents exposed about $600k, and the mining pool was also hit with a DoS. A patched version has been released—please upgrade immediately. Main-chain balances are not affected, but it highlights the trade-off between reducing observability and increasing detection difficulty for the privacy layer.
ChainNewsAbmedia7h ago
Aave, Kelp, LayerZero Seek $71M Frozen ETH Release from Arbitrum DAO
Aave Labs, Kelp DAO, LayerZero, EtherFi, and Compound filed a Constitutional AIP on the Arbitrum forum Saturday morning requesting the network's DAO release approximately $71 million in frozen ETH to support rsETH recovery efforts following last week's $292 million Kelp DAO exploit. The proposal
CryptoFrontier8h ago
Litecoin Suffers Deep Chain Reorganization After MWEB Zero-Day Exploit, Erasing Three Hours of History
Gate News message, April 26 — Litecoin experienced a deep chain reorganization (reorg) on Saturday after attackers exploited a zero-day vulnerability in its MimbleWimble Extension Block (MWEB) privacy layer, according to the Litecoin Foundation. The bug allowed mining nodes running older software to
GateNews14h ago
