Google’s Threat Intelligence Group details that the 'Coruna' exploit kit targets iPhones on iOS 13.0–17.2.1, using five exploit chains and 23 exploits to harvest cryptocurrency wallet seed phrases and financial data. The malware is distributed via fraudulent Chinese finance and crypto websites and delivers the PlasmaLoader payload to extract sensitive information from wallets including MetaMask, Trust Wallet, Uniswap, Phantom, Exodus, and Tonkeeper. Users are advised to update iOS or enable Lockdown Mode; affected sites have been added to Google Safe Browsing.