DarkSword iPhone Exploit Could Expose Crypto Wallet Data, Researchers Warn
A vulnerable iPhone may be at risk even if its owner never connects a wallet or approves a transaction. CertiK warns that specific malicious content opened in Safari could trigger a newer version of the DarkSword exploit on an unpatched device.
- A device exploit is different from a scam that tricks someone into signing a transaction.
- Researchers report spyware that can collect wallet-related and personal data.
- Update iOS. If you suspect a compromise, move funds using a fresh recovery phrase on a clean device.
What researchers report DarkSword can do
CertiK said attackers were using a newer version of DarkSword against unpatched iPhones. Its warning named MetaMask, Trust Wallet, Phantom, Exodus and Coinbase apps as reportedly targeted. It also cautioned that passwords and recovery phrases stored elsewhere on a phone could be exposed.
CertiK put the risk plainly: “Simply opening a malicious site in Safari can be enough: no wallet connection, no signature needed, ”
That warning applies to vulnerable devices exposed to specific malicious content. It does not mean ordinary visits to any website or ad are dangerous. The attack also differs from a familiar phishing scam. An exploit targets flaws in a phone’s software, rather than relying on someone to approve a transaction or reveal a recovery phrase.
Google Threat Intelligence Group described an exploit chain, a sequence of vulnerabilities used together, affecting iOS 18.4 through 18.7. The chain relied on six vulnerabilities. Google said a successful attack could deliver three malware families: GHOSTBLADE, GHOSTKNIFE and GHOSTSABER. Each had different capabilities.
Google reported that GHOSTBLADE collected cryptocurrency wallet data, device keychain information, messaging records, browser information, Notes databases and personal media. Apple’s keychain stores sensitive information such as passwords. These reported capabilities do not show that every type of data was taken from every infected device.
iVerify separately described a variant called P7 DarkSword. It said P7 could identify installed wallet apps and extract wallet-related data from imToken. Other reported commands could collect Notes databases, photos, application files and device information. According to iVerify, P7 processed keychain information on the phone before sending it. Earlier versions sent a keychain database elsewhere for processing.
iVerify also reported that P7 checked its server for instructions every 15 seconds by default, though operators could change the interval. That was a check-in for commands, not evidence that funds were stolen or wallet data extracted every 15 seconds.
The wallet names need careful interpretation. CertiK’s list does not show that those apps or their providers were breached, or that data was successfully extracted from each one. It describes reported targeting, but the available details do not say exactly what attackers sought from every named app. A compromised phone seeking wallet-related information is not the same as a breach of a wallet company’s systems.
Malicious ads and abandoned website integrations
An investigation by iVerify and Report URI described delivery methods beyond direct links. In one reported case, a World Cup-themed Instagram advertisement infected an employee’s device as the person scrolled through a feed. The same employee was later targeted by another DarkSword variant through a malicious link. This was a reported incident involving a particular ad and a vulnerable device, not evidence that scrolling Instagram generally infects phones.
Report URI traced a campaign it called DeadTag to expired domains once used by advertising and analytics services. Researchers said attackers bought those domains and used integrations still embedded in websites to redirect visitors. They identified hundreds of re-registered domains across thousands of sites.
iVerify and Report URI estimated that the network received 135 million monthly visits. That figure covers traffic across sites that could serve exploits when visitors met the attackers’ conditions. It does not count infections, successful exploits or affected wallet users. The available account does not explain how the estimate was calculated.
The investigation also described a fake Polymarket page that delivered Coruna and P7 DarkSword. It reported that an infection could begin when malicious content loaded on a vulnerable device. A fake page using a service’s name does not show that the legitimate service was compromised.
What is known, and what is not
Google said it observed campaigns against people in Saudi Arabia, Turkey, Malaysia and Ukraine involving commercial surveillance vendors and suspected state-sponsored actors. The available details do not name those actors or establish which groups targeted people in each country.
Google said the activity it tracked dated back to at least November 2025. It reported the vulnerabilities to Apple late that year, and said all had been patched by iOS 26.3, with most fixed earlier. Apple’s security advisories separately document serious iOS vulnerabilities, including an issue it said may have been exploited in a sophisticated attack against specific individuals. Apple does not identify that activity as DarkSword or link it to crypto theft. Its advisories also do not independently map the six flaws to Google’s DarkSword chain.
The reports are dated Nov. 6 for CertiK, March 18 for Google, Oct. 8 for iVerify and Oct. 21 for the iVerify and Report URI investigation. None includes a year in the available information, making it impossible to fully compare the publication and patch timelines.
The findings describe potential exposure and reported malware capabilities, not a confirmed count of infected devices, compromised wallets or stolen funds. The reporting summarized here also does not specify the names or technical details of the six vulnerabilities.
How iPhone users can reduce the risk
Install the latest iOS update available for your device. Google said the vulnerabilities in its reported chain had been patched by iOS 26.3, but the patch status for your device depends on its iOS version. If you cannot update right away, Google recommended Lockdown Mode, and CertiK advised it for higher-risk users. Treat it as a mitigation, not a substitute for installing security updates.
Keep recovery phrases out of Notes, Photos, screenshots and other phone apps. A valid recovery phrase can give someone control of a wallet. Updating your phone does not invalidate a phrase that may already have been exposed.
If you suspect a compromise, CertiK recommends moving funds to a new wallet created on a clean, updated device with a fresh recovery phrase. Do not enter the old phrase on a potentially compromised phone, and never reuse it. iVerify also advised changing passwords stored in the affected phone’s keychain. Do that from a clean device.
A hardware wallet can reduce your reliance on a general-purpose phone for significant holdings. It cannot protect a recovery phrase that has already been exposed or stored elsewhere.
Key questions and answers
-
Does DarkSword require a wallet connection or transaction signature?
No. CertiK said that opening specific malicious content in Safari could be enough to compromise a vulnerable device.
-
Which iOS versions did Google associate with the exploit chain?
Google described a chain affecting iOS 18.4 through 18.7 and said its vulnerabilities had been patched by iOS 26.3. Apple’s advisories do not independently confirm that those flaws form the DarkSword chain.
-
Were the named wallet companies breached?
The reported targeting does not establish a breach of the apps or their providers. It may refer to attempts to collect wallet-related data from an infected phone.
-
Does the 135 million monthly-visit estimate count infections?
No. It estimates traffic across sites that could serve exploits under certain conditions.
-
What should I do if my recovery phrase may be exposed?
On a clean, updated device, create a new wallet with a fresh phrase and move the funds. Do not reuse the potentially exposed phrase.
