Coruna and old iOS: can a hacked iPhone ask your contacts for money on WhatsApp?

In recent weeks, news sites in Türkiye and elsewhere have carried the same warning: WhatsApp accounts on older iPhones are being taken over without the owner noticing, and contacts are receiving “I urgently need money” messages. Most of these stories blame a piece of spyware called Coruna.

In this article we separate what Coruna actually is, what has been confirmed about the WhatsApp cases and what has not. Then we list the steps you can take today to protect your phone and your account.

This article is based on information public as of 2 November 2026. Investigations into the WhatsApp cases are ongoing and new findings may change the picture.

What is Coruna?

Coruna is an iOS exploit kit that Google Threat Intelligence Group (GTIG) disclosed on 4 March 2026. The name was given by its own developers. What we know:

• The kit contains five full exploit chains and 23 exploits in total.
• It targets iOS 13.0 to iOS 17.2.1, versions released between September 2019 and December 2023.
• It runs in the browser. Visiting a compromised or fake website on a vulnerable iPhone is enough: a hidden frame is injected into the page and the kit loads from there. The user does not need to download anything or approve anything.
• Google first saw parts of the kit in February 2025, used by a customer of a commercial surveillance vendor. It later found the kit planted on compromised Ukrainian websites and on a large number of fake Chinese finance and crypto sites.
• In its latest use the goal is money rather than classic espionage: according to Google, the payload targets crypto wallet apps and searches for QR codes and text such as “backup phrase” or “bank account”.

Two more details matter. Google says Coruna bails out when the device is in Lockdown Mode or the user is browsing in a private tab. More importantly, it is not effective against the latest iOS. On 11 March 2026 Apple also brought the related fixes to older iPhones and iPads that cannot run the latest iOS, in iOS 16.7.15 and iOS 15.8.7.

The WhatsApp money requests: Coruna or another chain?

The main source behind the recent coverage is an investigation published in May 2026 by Forenser, an Italian digital forensics firm. In real cases, Forenser found that:

• The affected devices ranged from iPhone 8 to iPhone 14, all running a version of iOS 16.
• Attackers sent requests for bank transfers from the victims’ own WhatsApp numbers to their most recent contacts. Victims found out from their contacts’ replies.
• Victims had not shared a code or scanned a QR code. No unknown device appeared under WhatsApp’s Linked Devices.
• Device logs showed an unusual, continuous series of WhatsApp resync events.

As a possible explanation, Forenser points to two flaws fixed in 2025 being used together: CVE-2025-43300 in Apple’s image processing framework and CVE-2025-55177 in WhatsApp’s linked-device synchronisation. Apple fixed the first for iOS 16 devices in iOS 16.7.12, and WhatsApp fixed the second in August 2025. Spain’s national cybersecurity centre, INCIBE-CERT, described the cases in the same terms in August 2026.

Here it pays to be precise:

• Forenser still describes this chain as a hypothesis and says its analysis is ongoing.
• Forenser’s report does not mention Coruna. The Coruna link made in news coverage has not been technically verified.
• WhatsApp has not confirmed that the new cases come from this chain.

So “Coruna is hijacking WhatsApp accounts” is not an established fact today. But what the two stories have in common is very clear.

What they share: iPhones that were never updated

Both Coruna and the WhatsApp cases Forenser examined go after iOS versions that are years out of date. Models on Forenser’s list such as the iPhone 11, 12, 13 and 14 can run far newer versions of iOS. Had their owners updated, the known flaws would very likely have been closed.

There are three common reasons people stay on old versions:

• “Updates slow my phone down”: every postponed update leaves already-fixed flaws open on the device.
• Devices out of support: models such as the iPhone 8 and iPhone X cannot go beyond iOS 16 and receive only a limited number of security fixes.
• Hand-me-down phones: older phones passed on to children or elderly relatives are often never updated, and those are exactly the people whose contacts scammers want to reach.

A three-minute checklist

1. Check your version: Settings > General > Software Update. Install any available update right away, and keep Automatic Updates on.
2. If your device is out of support: install the latest version it can run (for iOS 16, 16.7.12 or later). Then turn on Lockdown Mode under Settings > Privacy & Security. It limits some web and messaging features, but shrinks the attack surface considerably.
3. Update WhatsApp: make sure you are on the latest version from the App Store.
4. Review linked devices: WhatsApp > Settings > Linked Devices. Log out of any session you do not recognise. Remember that in Forenser’s cases the list looked empty; a clean list alone does not prove you are safe.
5. Turn on two-step verification: WhatsApp > Settings > Account > Two-step verification. Never share your six-digit code with anyone, including someone claiming to be WhatsApp support.
6. Know the private-tab detail: according to Google, private browsing is one of the conditions under which Coruna stops. Treat it as a stopgap, not a fix.

Someone asked your contacts for money. Now what?

• Call your contacts. Warning them through the compromised account does not help; the attacker may see those messages too.
• If anyone has sent money, they should call their bank immediately and ask for the transfer to be stopped or reversed.
• Log out of WhatsApp and re-verify your number, then turn on two-step verification. In Forenser’s cases, updating the app and re-verifying the account appeared to cut off the attacker.
• Update iOS. If you still suspect malware on the phone, back it up and restore it to factory settings.
• Keep the evidence and report it. Take screenshots of the messages and report the incident to the police cybercrime unit in your country.

One rule is enough for friends and family: confirm every money request that arrives by message with a phone call, no matter who it seems to come from.

For companies: employees’ phones are part of the attack surface

A hijacked employee WhatsApp account can message not only family but also customers, suppliers and the finance team. “Our IBAN has changed” or “this payment has to go out today” are well-known ways to get money out of a company. Steps companies can take:

• Mobile device policy: set a minimum iOS version for phones used for work and enforce it with mobile device management (MDM). Keep out-of-support devices away from critical accounts.
• Payment process: never act on a payment or bank-detail change requested by message without calling back a number you already know.
• Awareness: experiencing the scenario once teaches far more than reading about it. Our phishing simulations test this kind of social engineering realistically.

For device management and update policies, our server and IT management service can help.

Conclusion

The claim that Coruna is hijacking WhatsApp accounts is not confirmed today. The real message stays the same: both Coruna and the WhatsApp cases in Italy target iPhones that have not been updated. None of these known flaws works on an iPhone running the latest iOS.

The to-do list is short: update the phone, turn on Lockdown Mode if it no longer gets updates, enable two-step verification on WhatsApp and confirm every money request by phone. If you want to review your company’s mobile devices and payment processes with this in mind, see our cybersecurity services or get in touch.

Sources: Google Threat Intelligence Group: Coruna, Forenser: WhatsApp accounts compromised on iPhones with iOS 16, INCIBE-CERT, Apple: security content of iOS 16.7.12, BleepingComputer: Apple’s Coruna fixes for older devices, The Hacker News: CVE-2025-43300 backport and the WhatsApp flaw

Bu yazı Türkçe olarak da mevcut — Türkçe oku →