Coruna iOS exploit kit in malicious ads seeks crypto seed phrases
Original title: Coruna iOS Exploit Kit Hidden Behind Malicious Ads Targets Crypto Seed Phrases, ADEX Reports
ADEX says about 50 advertiser accounts delivered version-matched chains for iOS 13.0 through 17.2.1, mainly on older devices.
Anti-fraud firm ADEX describes a Coruna exploit kit campaign that used malicious ads and roughly 50 advertiser accounts sharing one back end. A hidden iframe fingerprints iPhones and iPads, serves reviewers a harmless page, then delivers a .min.js exploit chain matched to the iOS version and chip. The implant searches for wallet recovery seed phrases. The chains cover iOS 13.0 through 17.2.1, leaving older hardware most exposed.
Unconfirmed: ADEX says the description covers observed behaviour and does not identify any person or company.
- Malicious iOS scripts accounted for about one in five Q3 2026 ad suspensions.
- Bots, Lockdown Mode, private browsing and suspicious IPs saw a harmless page.
- ADEX found AI indicators in 52 percent of distinct fraud schemes it observed.
- A 2027 forecast of attacks on AI agents is not a measured category.
Impact: theft of cryptocurrency wallet recovery seed phrases
| Product | Affected |
|---|---|
| Apple iOS | 13.0 through 17.2.1 |
- 1.Update iPhones and iPads that can run a current iOS release.
- 2.Treat devices that cannot leave iOS 17.2.1 or older as still exposed.
From the original article
3 min read at gbhackers.com
Malicious iOS scripts have become a leading cause of ad platform suspensions. They accounted for about one in five suspensions in Q3 2026, according to the State of Ad Fraud 2026: ADEX Trust & Safety Report from anti-fraud firm ADEX. The report examines one scheme in detail.
By Kaaviya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.