Researchers at Google have warned of a cyber-attack tool designed to target older versions of the Apple iPhone operating system and steal cryptocurrency wallet information.
The company’s security researchers said the exploit kit, known as “Coruna,” can attack devices running iOS versions 13.0 to 17.2.1, released between 2019 and 2023. The findings were published in a report by Google’s Threat Intelligence Group (GTIG) on March 2026.
According to the report, the exploit kit contains five complete iOS exploit chains and 23 individual vulnerabilities, including some previously unknown to the public.
Google researchers said the exploit is typically delivered through fraudulent cryptocurrency websites. When a user opens one of these sites on an affected iPhone, hidden code can analyse the device and deploy a tailored attack designed to extract financial information.
The report states that the exploit searches for cryptocurrency wallet seed phrases and scans messages for keywords such as “backup phrase” or “bank account.” It can also target data linked to widely used crypto applications such as MetaMask and Uniswap.
Researchers said they first identified the exploit kit in February 2025 when it appeared in activity linked to a surveillance vendor attempting to compromise a mobile device.
Later in 2025, the same framework was found on compromised Ukrainian websites that delivered the exploit only to selected iPhone users based on their location.
By December 2025, investigators discovered the same system embedded in a large number of fake finance-related websites believed to be linked to Chinese cybercriminal operations. One of the websites mimicked a cryptocurrency trading platform to lure users to open it on their phones.
The Google report said it remains unclear how the exploit kit spread beyond its original environment, but suggested that there may be an active market for previously developed hacking tools.
Security company iVerify said the technology behind the exploit appeared highly sophisticated and may have required significant resources to develop.
The company’s co-founder, Rocky Cole, told WIRED that the tool “is highly sophisticated, took millions of dollars to develop, and it bears the hallmarks of other modules that have been publicly attributed to the US government.”
However, researchers at Kaspersky said they had not found clear technical evidence linking the exploit kit to previously identified government-developed cyber tools.
Google researchers said that the exploit does not affect devices running the latest version of Apple’s operating system. The company urged iPhone users to install the most recent software updates.
“iPhone users are strongly urged to update their devices to the latest version of iOS,” the Google Threat Intelligence Group said in the report.
The researchers also advised users who may be exposed to high-risk cyber threats to activate Lockdown Mode, a security feature introduced by Apple to limit potential attack methods on mobile devices.
Cybersecurity analysts say the warning is relevant to users globally, including in countries where cryptocurrency use is widespread. Nigeria is among the markets with high adoption of digital assets, and criminals often use fake investment platforms or phishing websites to obtain victims’ wallet credentials.
