Scammers' WhatsApp Method Exposed: Urgent Warning for iPhone Users
Coruna software exploiting security vulnerabilities in older iOS versions secretly hijacks WhatsApp sessions and requests money from contacts without the user's knowledge. Following the exposure of the scammers' method, experts issued an update warning.
Software updates on smartphones demonstrate security necessity once again. Security risks have always existed for phones with old operating systems. Even iPhones risk user data when not updated. One of these spyware tools is named Coruna.
The malware named Coruna, targeting old iOS versions, hijacks users' WhatsApp accounts and conducts money fraud in the background. Investigations by an Italy-based digital forensics company showed that attackers exploiting system vulnerabilities interfered with WhatsApp's pairing infrastructure. Apple distributed new updates on October 26, 2026, to patch vulnerabilities in the operating system.
Hides Itself from WhatsApp Linked Devices Menu
Attackers send messages requesting urgent money to contacts via hijacked accounts. These sent scam messages do not appear in the account owner's chat list. This prevents the attack from being noticed for a long time.
According to research by Italian forensic experts, Coruna targets the multi-device linking protocol of the WhatsApp application. The attacker integrates their device into the victim's account and hides this connection from the app's "Linked Devices" list. When checking settings, users cannot see an unfamiliar session and fail to realize their account is controlled by someone else.
A Single Web Link is Enough to Infiltrate the Device
Technical data shared by the Google Threat Intelligence Group shows that Coruna exploits vulnerabilities between iOS 13.0 and iOS 17.2.1 versions. 23 different security vulnerabilities in the system can be chained together by this attack tool.
Users do not need to download an external file or application. Opening a malicious website created by attackers in Safari allows infiltration into the system kernel. Apple stated in its latest security bulletin that it received reports indicating a vulnerability in these older iOS versions may have been actively exploited in targeted advanced attacks.
Affected iPhone Models and Security Updates
According to a report by The Wall Street Journal, Apple patched more than 160 vulnerabilities across various layers of the operating system, including the Safari WebKit browser engine. Released updates contain different packages based on device models:
| Update Version | Supported iPhone Models | Scope |
|---|---|---|
| iOS 27.2 and iOS 26.7.2 | iPhone 11 and later models | WebKit and system component security patches |
| iOS 18.7.11 | iPhone XS, iPhone XS Max, iPhone XR | Critical security fixes for older-generation devices |
Device owners need to install the latest security package by navigating to Settings > General > Software Update.
What Precautions Can Users Take Against the Attack?
To ensure account security, settings within WhatsApp alone are not sufficient; the operating system must also be kept at the latest version. Security experts recommend keeping two-step verification enabled and not clicking on untrusted links.
People who receive unusual notifications asking for money from acquaintances need to reach the account holder via an alternative phone call. Users who suspect that their account is being used by someone else can reclaim their session by re-registering their phone number and entering the six-digit code received via SMS. However, if the operating system is infected with Coruna software, reinstalling WhatsApp alone does not ensure security; the phone must be technically cleared of malware.
This article was translated from Turkish. Read the original article in Turkish.
