According to researchers, a tool called Coruna targets devices running iOS versions from 13.0 to 17.2.1. The malicious module searches for QR code images on the smartphone and analyzes text files in an attempt to find phrases related to cryptocurrency wallet recovery. If such data is found in Apple Notes, the malware sends the information to a command-and-control server.

Additionally, Coruna can load additional modules. These can intercept the operation of popular crypto wallets, including MetaMask, Trust Wallet, Exodus, and Phantom. However, Coruna does not work on the latest versions of iOS. Experts recommend iPhone owners install the latest system updates to reduce the risk of hacking.
According to Google analysts, the spread of Coruna shows how sophisticated hacking tools are gradually shifting from state surveillance operations to use in financial fraud. Initially, such vulnerabilities were used for espionage and cyber spying, but later they began to be exploited by scammers, including in the creation of fake copies of Chinese crypto websites.
Earlier, analysts from Chainalysis reported that in 2025, the number of ransomware attacks increased by 50%, and the total ransom paid in cryptocurrency amounted to around #BitcoinHitsOneMonthHigh million.