TLDR
A browser based iPhone exploit called DarkSword is actively being used to steal crypto wallet data from unpatched iOS devices.
- Security researchers report that DarkSword and its payload Coruna or Ghostblade exploit Apple WebKit bugs to grab sensitive data from iPhones used for crypto.
- The malware targets major wallet apps and scans photos and notes for BIP39 recovery phrases, putting any seed stored on an iPhone at direct risk if the device is unpatched.
- Apple has shipped fixes in recent iOS versions, so the main risks now cluster around unupdated devices, bad browsing habits, and poor seed storage practices.
Deep Dive
1. What This Exploit Is
Cybersecurity teams including Google Threat Intelligence describe an iOS focused malware family, dubbed Ghostblade, that uses a browser exploit toolkit called DarkSword to compromise iPhones.
Reports say DarkSword abuses vulnerabilities in Apples WebKit and JavaScriptCore engines to execute malicious JavaScript in Safari or in-app browsers, then deploys payloads like the Coruna malware that specialize in data theft from crypto users.
Apple has reportedly patched the known DarkSword related bugs in iOS 26.3, but researchers such as Censys still see DarkSword infrastructure active, which means unpatched iPhones remain viable targets.
Confidence: high because multiple independent security and news outlets describe the same exploit chain and patch status.
Treat unpatched iPhones as high risk devices for handling private keys or signing important transactions.
2. How It Steals Crypto
Once DarkSword gains code execution, its payload rapidly collects and exfiltrates sensitive data, including private keys, wallet credentials and other secrets tied to crypto apps.
Security write ups say Coruna or Ghostblade explicitly target popular wallets such as Coinbase, MetaMask, Trust Wallet, Phantom, Exodus, Uniswap front ends and others, harvesting anything useful for taking control of accounts.
The malware can also scan photos and notes for BIP39 recovery phrases, and access messaging apps like iMessage, Telegram and WhatsApp, plus SIM and device identity data, increasing the chance it can reconstruct enough information to move funds.
Any seed phrase, key backup or login stored anywhere on an iPhone can become a target if the device is compromised.
3. Risk Management For iPhone Crypto Users
The primary technical mitigation is to run an iOS version that includes Apples DarkSword related patches, since that closes the specific WebKit bugs the toolkit relies on.
Operationally, treating an iPhone as hot means limiting what is stored there: avoid keeping recovery phrases in photos or notes, minimize direct custody of large balances on mobile, and favor hardware or multisig setups for larger holdings.
It is also useful to be cautious with unknown links, profiles and dapps opened in mobile browsers, and to watch for official advisories from Apple and major wallet providers about any new iOS exploit campaigns.
The exploit does not make iPhones unusable, but it raises the bar for hygiene; updated software and strict seed handling materially reduce the attack surface.
Conclusion
The new iPhone exploit shows that browser level bugs on iOS can directly threaten crypto wallets when phones double as both browsing devices and signing devices.
For most users the key shift is not abandoning iPhones, but reducing trust in them as long term secret storage while keeping them fully patched and being strict about where seeds and keys live.
CoinsKid.Com