In the scam-wave phase, GTIG says it observed the JavaScript framework behind Coruna deployed across a “very large set” of fake Chinese websites largely themed around finance. One example cited by GTIG is a fake WEEX-branded crypto exchange page that tried to push visitors onto an iOS device—after which a hidden iFrame would be injected to deliver the exploit kit “regardless of their geolocation.”
The delivery mechanics matter because they blur the line between traditional phishing and outright device compromise: in GTIG’s telling, simply arriving on the booby-trapped page from a vulnerable iPhone was enough to begin the chain. The framework fingerprints the device to identify model and iOS version, then loads the appropriate WebKit remote code execution exploit and a pointer authentication (PAC) bypass.
At the end of the chain, GTIG says Coruna drops a stager it calls PlasmaLoader (tracked as PLASMAGRID) and describes it as focused less on classic surveillance features and more on stealing financial information. According to GTIG, the payload can decode QR codes from images stored on the device and scan text blobs for BIP39 word sequences, along with keywords such as “backup phrase” and “bank account”, including in Apple Memos, which it can then exfiltrate.
The broader arc was also flagged by mobile security firm iVerify, which published its own findings around the same time as GTIG’s report. “And that’s exactly what happened again here, but on mobile devices. Phone OEMs do as good a job as anyone can do…”
What Crypto Users Can Do NowGoogle says Coruna “is not effective against the latest version of iOS,” and urges users to update. If updating isn’t possible, GTIG recommends enabling Apple’s Lockdown Mode. GTIG also says it added the identified websites and domains to Google Safe Browsing to help reduce further exposure.
For crypto-native users, the immediate takeaway is practical: mobile wallets sit at the intersection of high-value assets and high-frequency web traffic, which makes “visit-to-compromise” campaigns uniquely dangerous. GTIG’s reporting suggests the scam funnel wasn’t just about getting victims to connect wallets, it was about getting them onto the right device, on the right iOS version, so exploitation could do the rest.
At press time, the total crypto market cap stood at $2.45 trillion.
