<p>A sophisticated exploitation kit targeting iPhones has been revealed by Google. Named Coruna, it is used to steal cryptos via phishing attacks. An analysis of a major threat for iOS users in 2026.</p>
<div class="in-brief">
 <div class="in-brief--container"><span></span><span></span>
  <h2 class="in-brief--title" id="in-brief">In brief</h2>
  <ul>
   <li>Google reveals an iOS kit named Coruna used to steal cryptos via phishing attacks, targeting iPhones (versions 13.0 to 17.2.1).</li>
   <li>The Coruna kit exploits iOS vulnerabilities to extract crypto wallet recovery phrases via malicious websites.</li>
   <li>To protect against Coruna, it is crucial to update your iPhone, enable lockdown mode, and avoid suspicious crypto-related links.</li>
  </ul>
 </div>
</div>
<h2 id="h-google-reveals-coruna-a-crypto-phishing-kit-targeting-ios-users">Google reveals Coruna, a crypto phishing kit targeting iOS users</h2>
<p>In February 2025, the Google Threat Intelligence Group (GTIG) discovered Coruna, an exploitation kit specifically targeting Apple devices running iOS (versions 13.0 to 17.2.1). Indeed, this kit uses advanced exploit chains to <a href="https://www.cointribune.com/en/urgent-an-apple-flaw-puts-your-cryptos-at-risk-2/" rel="noopener noreferrer nofollow">compromise iPhones</a> via malicious websites! Often, fake crypto sites.</p>
<div class="my-4">
 <div class="ads "></div>
</div>
<p>Once the device is infected, Coruna extracts the crypto wallet recovery phrases, passwords, and other sensitive data. GTIG revealed that Coruna has been used by malicious actors to target iPhone users through phishing campaigns. These attacks generally occur in multiple stages:&nbsp;</p>
<ul>
 <li>The user is prompted to visit a compromised site, where a JavaScript script identifies the device and delivers the appropriate exploit;</li>
 <li>Victims, often cryptocurrency holders, have their assets stolen in seconds.</li>
</ul>
<div class="wp-block-image">
 <figure class="aligncenter size-large is-resized"><img src="https://www.cointribune.com/app/uploads/2026/03/IMG_4227-1024x305.png" alt="The iPhone user is prompted to visit a compromised site, where a JavaScript script identifies the device and delivers the appropriate exploit." width="636" height="188">
  <figcaption><em>The JavaScript script used by Coruna, reveals Google.</em>
  </figcaption>
 </figure>
</div>
<p>The origin of Coruna remains unclear, but <a href="https://cointelegraph.com/news/google-warns-crypto-scams-using-new-and-powerful-iphone-exploit-kit" rel="noopener noreferrer nofollow">GTIG noted similarities with tools previously attributed to state groups</a>. The kit was spotted on fake Chinese crypto sites, as well as in attacks targeting Ukrainian users. Google alerted Apple, which has since fixed some vulnerabilities. However, the threat persists for devices not updated.</p>
<div class="wp-block-image">
 <figure class="aligncenter size-large is-resized"><img src="https://www.cointribune.com/app/uploads/2026/03/IMG_4228-1024x892.jpeg" alt="GTIG revealed that Coruna was used by malicious actors to target iPhone users via phishing campaigns." width="499" height="434">
  <figcaption><em>Google reveals the existence of Coruna in the iOS system.</em>
  </figcaption>
 </figure>
</div>
<h2 id="h-crypto-phishing-how-to-protect-yourself-from-coruna">Crypto phishing: how to protect yourself from Coruna?</h2>
<p>To avoid becoming a victim of Coruna, the first step is to update your iPhone to the latest iOS version. Apple has released patches for the vulnerabilities exploited by this kit. This makes updated devices immune to this threat. Next, also enable Lockdown Mode, a feature designed to block sophisticated attacks like Coruna.</p>
<div class="affiliate-button"><a href="https://bitpanda.pxf.io/c/2801338/1632019/15871" rel="noopener noreferrer nofollow">Your 1st cryptos with Bitpanda</a><a href="https://www.cointribune.com/en/sponsored-content/" rel="noopener noreferrer nofollow">This link uses an affiliate program.</a>
</div>
<p>Additionally, avoid clicking on suspicious links, especially from sites or emails related to crypto. Always verify the authenticity of URLs and prioritize official platforms for your transactions. Finally, use hardware wallets to store your cryptocurrencies (<a href="https://www.cointribune.com/bitcoin/" rel="noopener noreferrer nofollow">bitcoin</a>, ethereum…). These offer an extra layer of security against online attacks.</p>
<p>The revelation of Coruna by Google reminds us that <a href="https://www.cointribune.com/en/crypto-phishing-losses-plunge-83-in-2025-but-wallet-threats-persist/" rel="noopener noreferrer nofollow">crypto phishing attacks</a> are becoming increasingly sophisticated. Although solutions exist, protecting your assets primarily depends on your vigilance. The question remains: are users ready to adopt best practices to guard against these constantly evolving threats?</p>

IPhone: Google uncovers an iOS kit used for crypto phishing

Table of Contents

Cointribune EN

Other articles published on Mar 6, 2026

Join our free newsletter for daily crypto updates!