Disclaimer: Information found on CryptoreNews is those of writers quoted. It does not represent the opinions of CryptoreNews on whether to sell, buy or hold any investments. You are advised to conduct your own research before making any investment decisions. Use provided information at your own risk.
CryptoreNews covers fintech, blockchain and Bitcoin bringing you the latest crypto news and analyses on the future of money.
Cybersecurity experts at Google have identified a toolkit that fraudsters utilize to compromise iPhone devices and steal seed phrases from cryptocurrency wallets.
According to the researchers, a tool named Coruna targets devices running iOS versions from 13.0 to 17.2.1. The malicious module searches for images containing QR codes on the smartphone and examines text files in an effort to locate recovery phrases for crypto wallets. If such information is found in Apple Notes, the malware transmits the data to a command server.
Related Posts
Additionally, Coruna has the capability to download supplementary modules. These can intercept the operations of popular cryptocurrency wallets, including MetaMask, Trust Wallet, Exodus, and Phantom. However, Coruna is ineffective on the latest iOS versions. Experts advise iPhone users to install the latest system updates to mitigate the risk of breaches.
Google analysts believe that the spread of Coruna illustrates how sophisticated hacking tools are gradually shifting from state surveillance operations to applications in financial fraud. Initially, such vulnerabilities were employed for surveillance and cyber espionage, but they have since been adopted by criminals, including for the creation of counterfeit versions of Chinese crypto websites.
Previously, specialists from the analytics firm Chainalysis reported that in 2025, the number of attacks utilizing ransomware increased by 50%, with the total amount of ransom payments in cryptocurrency reaching approximately $820 million.
