Crypto Scams Using ‘Powerful’ iPhone Exploit Kit: Google

Google Threat Intelligence Group (GTIG) has identified a sophisticated exploit kit called “Coruna” targeting iPhones running iOS versions 13.0 through 17.2.1. This kit contains five full exploit chains and 23 exploits, some previously unknown. GTIG first discovered it in February 2025 and tracked its use by a suspected Russian espionage group against Ukrainians, and later on fake Chinese crypto websites designed to steal assets. The kit scans for financial information, including crypto seed phrases and keywords, and targets popular crypto apps like Uniswap and MetaMask. GTIG advises users to update to the latest iOS version or enable Lockdown Mode. While GTIG did not name the source, mobile security company iVerify suggested the highly sophisticated kit might have originated from or been built by the US government before being used by adversaries and cybercriminals, though Kaspersky researchers noted a lack of direct code reuse evidence in published reports.

(Source：Cointelegraph)