Google Warns New Malware Can Steal Crypto From iPhones

Key Insights

• The Google Threat Intelligence Group (GTIG) has released a report on a new malware. It targets financial data on iPhones running older iOS versions.
• The malware known as Coruna morphed from a state surveillance tool to an exploit tool being deployed by scammers.
• iPhone users are advised to update to the latest iOS or enable Lockdown Mode on their phone.

Security researchers at Google have warned about a new iPhone malware that can steal crypto from users’ wallets. The malware kit named Coruna runs on iPhones operating on iOS 13.0 to 17.2.

According to a report by the Google Threat Intelligence Group (GTIG), the malware is a powerful kit. It contains five iOS exploit chains and 23 exploits. The group first identified the malware in 2025 and noted a mass increase in its usage by the end of the year.

Coruna Moved from a Surveillance Tool to a Scam Malware

The report described Coruna as a sophisticated malware kit that was initially designed as a surveillance tool, likely by state-sponsored actors. However, it has now become a tool for financial scams, being used by various threat actors.

GITG noted that malware was a Zero-day vulnerability that Apple had addressed with iOS 17.3 in January 2024. It spread to mass use in 2025. A Russian espionage group used it to target Ukrainian users by compromising several websites in the country.

The malware was widely used by a scam group operating in China. With this, the exploit kit was found on several finance-related websites in the country. In most cases, the exploit is embedded into several fake websites impersonating genuine platforms.

Most of these websites prompt users to visit on an iOS device, and those who do are injected with the exploit kit.

It said:

However, the exploit did not affect iPhones running iOS 17.3 or later, meaning most of the latest iPhones with the latest iOS version are not affected.

How Does Coruna Work?

Meanwhile, Google researchers warned that Coruna is highly effective. Yhe exploit can steal financial data and sensitive information from users’ devices. This means everything from bank account details to crypto wallet seed phrases stored on vulnerable iPhones could be stolen.

They noted that malware has a uniform design with a single function. It extracts sensitive information or crypto wallets by actively scanning crypto apps.

It even scans photos containing keywords such as backup phrase, seed phrase, etc. Extracted data is sent to attackers who can use it to steal crypto assets.

Some of the targeted apps include MetaMask, Bitpie, BitKeep, Ton Wallet, Phantom, Solflare, Uniswap, and several others.

The report did not state the financial impact of the malware. However,, it emphasized the need for iPhone users to update their iOS to the latest version. It added that those who are unable to update should enable Apple Lockdown Mode.

The post Google Warns New Malware Can Steal Crypto From iPhones appeared first on The Market Periodical.