DarkSword iPhone Exploit Threatens Crypto Wallets Now

CertiK warns: DarkSword iOS exploit targets crypto wallets

Security firm CertiK has issued a high-priority warning about a renewed wave of DarkSword iOS exploits that put cryptocurrency wallets and sensitive on-device credentials at risk. According to CertiK’s Nov. 6 alert, the attack chain can deliver spyware to unpatched iPhones simply by loading a malicious webpage in Safari — no wallet connection or user signature is required. Targeted applications reportedly include MetaMask, Trust Wallet, Phantom, Exodus and Coinbase, along with passwords and recovery phrases stored elsewhere on the phone.

Why this matters for crypto users

For anyone who holds digital assets, an exploit that harvests seed phrases, keychain entries, or wallet backups is a critical threat. The DarkSword chain is not limited to tricking users into approving transactions — it instead abuses multiple iOS vulnerabilities to install spyware that can scan for installed wallet apps, collect private data, and execute remote commands. Because attackers can obtain credentials and recovery phrases silently, funds in hot wallets or on compromised devices may be drained without any on-screen prompts.

Technical overview: six vulnerabilities and several malware families

Google’s Threat Intelligence Group documented the underlying exploit chain on March 18, showing that the attack assembled six separate iOS flaws to compromise devices running iOS 18.4 through 18.7. By chaining these vulnerabilities, threat actors could achieve device compromise and persistently install malware components that extract sensitive information.

Google observed three related malware families delivered after successful exploitation: GHOSTBLADE, GHOSTKNIFE and GHOSTSABER. Their capabilities varied from passive data collection to remote command-and-control functionality. GHOSTBLADE in particular was seen harvesting cryptocurrency wallet data, device keychains, messaging histories, browser information, Apple Notes, and personal media. Campaign telemetry attributed operations against targets in Saudi Arabia, Turkey, Malaysia and Ukraine, and suggested both commercial surveillance vendors and possible state-sponsored operators were involved.

Patching status and affected iOS versions

Google said it reported the vulnerabilities to Apple and that patches were released by iOS 26.3, with many fixes arriving earlier. However, devices that remain on older iOS builds — especially iOS 18.4–18.7 — are vulnerable until updated. Users who cannot immediately update should assume any sensitive material stored on-device is at risk and take protective steps.

P7 DarkSword: a refined spyware variant with remote control

Independent mobile security firm iVerify disclosed a refined variant, nicknamed P7, in an Oct. 8 report after investigating an infection on a customer’s device. P7 reduces its forensic footprint, improves stability, and implements two-way communication with attacker-controlled infrastructure. The implant removed some logging, scaled back process injections and used browser storage to hinder repeated exploitation.

P7 included commands to enumerate installed wallet applications and to extract wallet-specific data — researchers noted imToken as one target. The implant could also harvest Apple Notes, photos, application data and device metadata. By default it polled its server for instructions every 15 seconds, but operators could reconfigure that interval. Unlike prior variants that exfiltrated full keychain databases for remote processing, P7 parsed keychain contents locally before sending a reduced dataset to operators.

How the malware reaches devices: malvertising and expired domains

Delivery methods observed by iVerify and Report URI included malicious advertisements and hijacked web integrations that require no click. In one case, a World Cup-themed Instagram ad infected a device while the user simply scrolled their feed. Report URI tracked a campaign named DeadTag that abused expired analytics and ad service domains which attackers re-registered and used to redirect embedded integrations on thousands of sites.

Investigators found hundreds of re-registered domains embedded across many websites and estimated the malicious network could receive roughly 135 million monthly visits. Some landing pages were specifically crafted to auto-deliver DarkSword variants when content loaded on vulnerable devices — victims did not need to tap a link to be infected.

Practical guidance: how to protect crypto assets and accounts

CertiK and other researchers recommend immediate, practical steps for users who hold crypto or sensitive account credentials:

• Update iOS immediately: Install the latest iOS security updates via Settings > General > Software Update.
• Assume compromise for exposed devices: If you suspect a phone was infected, move funds to a new wallet generated on a clean, updated device and never reuse the old seed phrase.
• Remove seed phrases from device storage: Don’t keep recovery phrases in Photos, Notes, screenshots, or messaging apps.
• Use hardware wallets for large holdings: Store private keys offline whenever possible to reduce hot wallet risk.
• Enable Lockdown Mode for high-risk users: Both Google and CertiK recommended Lockdown Mode where updating isn’t immediately possible.
• Rotate passwords and credentials: iVerify advised changing passwords stored in an affected phone’s keychain and reviewing accounts for unusual activity.

Final takeaways for the crypto community

DarkSword demonstrates how powerful web-based iOS exploits can be for stealing cryptocurrency credentials without any explicit wallet interaction. The combination of malvertising, re-registered domains and a low-interaction infection vector makes this a significant threat to users who store recovery phrases or wallet backups on mobile devices. The strongest defenses are timely iOS updates, avoiding unknown or suspicious links and ads, moving significant funds to hardware wallets, and creating new recovery phrases on a verified clean device if compromise is suspected.

For custodial or third-party wallet users, monitor exchange and wallet service alerts and enable all available account protections like two-factor authentication. Staying informed about exploit disclosures from Google, CertiK and independent security researchers is critical — attackers continually evolve their tactics, and so must wallet security practices.