🐰 🦇

🚨 All it takes is one website and your crypto disappears: Coruna may be the EternalBlue moment for iOS exploits. For years, large-scale exploitation of iPhones was considered impractical. Coruna proves otherwise. Recently exposed by the Google Threat Intelligence Group, Coruna is a modular, state-grade iOS exploit kit that shows how sophisticated cyber capabilities developed by governments or surveillance actors can eventually leak into criminal ecosystems. The framework contains five complete exploit chains built from 23 vulnerabilities targeting Apple devices. These chains combine: - WebKit remote code execution - Privilege escalation - PAC (Pointer Authentication) bypass (!!) - Sandbox escape - Page Protection Layer bypass Together, they enable full compromise of an iPhone from a simple website visit. The implications are immediate. Coruna has already been used primarily for cryptocurrency theft. The attack path is brutally simple: your keys sit in a software wallet on your iPhone, you visit a compromised website, and your crypto is gone. Once inside the device, the malware can: - Steal assets from software wallets - Extract seed phrases stored in Apple Notes or in your photos - Harvest photos, emails, and other sensitive data Researchers observed the toolkit targeting 18 cryptocurrency apps, including MetaMask, Trust Wallet, and Exodus Wallet. Coruna works out of the box against devices running iOS 13 through iOS 17.2.1, covering releases from 2019 to 2023. That represents hundreds of millions of potentially vulnerable devices worldwide. So far, researchers estimate that tens of thousands of iPhones have actually been infected. More recent iOS versions are also actively targeted by nation-state actors, though not exploited yet at this scale. But the trajectory is clear: as exploit development accelerates, particularly with the assistance of AI, these capabilities will become cheaper and more widely available. Large-scale mobile compromise will become more common. The lesson is straightforward: Storing valuable secrets on general-purpose devices is fundamentally risky. When a single browser visit can compromise the entire mobile phone, relying on software wallets to protect high-value assets is no longer a defensible security model. For those interested by the technical details, I recommend this excellent report from Google Threat Intelligence group. cloud.google.com/blog/topics…

🚨 Hackers are using large language models to scan EVM contracts at scale, finding vulnerabilities in code deployed years ago. The attack vector: tokens you approved to DeFi contracts 6+ years ago. When you approved that contract back then, you gave it permanent access to move your tokens. That approval still exists. If the contract has a vulnerability, attackers drain your tokens without triggering any warning or requiring a new signature. Hardware wallets protect your private keys, but not against contracts you already authorized. The fix takes 2 minutes: - Visit Revoke.cash or @Rabby_io - Check active approvals - Revoke unused ones This is happening right now. Multiple exploits in the past month alone. Stay sharp 🫡