Google has discovered a new exploit kit, named "Coruna," designed to steal crypto wallet seed phrases on iPhones running iOS versions 13.0 up to 17.2.1, targeting Apple iPhone users. The Google Threat Intelligence Group (GTIG) discovered the kit in February 2025 and has tracked its use by a suspected Russian espionage group against Ukrainians and fake Chinese crypto websites. The kit has five full iOS exploit chains and 23 exploits, including ones previously unknown to the public. GTIG has urged iPhone users to update their devices to the latest software version of iOS and place the phone in "Lockdown Mode" to combat sophisticated attacks. The mobile security company iVerify suggested the exploit kit could have been built or bought by the US government, but Kaspersky’s principal security researcher said there is no evidence of actual code reuse in the published reports to support attributing the same authors.