New iPhone exploit targets mobile crypto wallets

TLDR

A newly disclosed exploit chain called DarkSword targets vulnerable iPhones and can silently harvest data from major mobile crypto wallets.

1. DarkSword and its Ghostblade malware hit iOS 18.4 to 18.7 via malicious websites and are explicitly tuned to search for popular exchange and wallet apps.
2. Stolen data can include app sessions, passwords, seed phrases stored on the phone, and messaging/2FA data, which together can enable full crypto account takeover.
3. Updating to the latest iOS, keeping seed phrases off phones, and using hardware wallets for larger balances significantly reduces the impact of this class of attack.

Deep Dive

1. How DarkSword Targets Wallets

Google researchers have documented an iOS exploit chain named DarkSword that affects iPhones running iOS 18.4 to 18.7 and delivers malware focused on cryptocurrency apps on unpatched phones. It is triggered simply by visiting a compromised or malicious website on a vulnerable device, no tap or extra download required.

Once the exploit lands, it installs Ghostblade, a JavaScript based data stealer that actively searches for major crypto exchange apps like Coinbase, Binance, Kraken, KuCoin, OKX, MEXC and wallet apps such as Ledger, Trezor, MetaMask, Exodus, Uniswap, Phantom, and Gnosis Safe on the device, as detailed by Decrypt. Campaigns have already been observed in countries including Saudi Arabia, Turkey, Malaysia, and Ukraine.

Apple has shipped a fix; community reporting notes that newer iOS builds (for example iOS 26.3) patch the six underlying vulnerabilities and harden Safe Browsing, but any device left on the older range remains exploitable.

2. What Data And Funds Are At Risk

Ghostblade and related DarkSword components are designed for rapid, broad data theft. They exfiltrate wallet app data, authentication tokens, browser cookies, Wi-Fi credentials, location history, photos, and message history from apps like iMessage, Telegram, and WhatsApp, according to Google Threat Intelligence coverage.

Separate analysis highlights that the toolkit can also reach seed phrases, passwords, or private keys that users have saved in Notes, screenshots, password managers, or iCloud, allowing attackers to recreate wallets or hijack exchange accounts from another device. A CoinsKid community summary warns that this effectively turns any seed phrase stored digitally on an unpatched iPhone into a high value target for DarkSword style campaigns.

Because the malware focuses on stealing credentials rather than breaking blockchains, even cold or hardware wallets become vulnerable if their recovery phrases are exposed via the phone.

3. Practical Steps For Mobile Crypto Users

1. Update iOS on all iPhones used for crypto to the latest available version as soon as possible, especially if you were on 18.4 to 18.7. This cuts off the specific DarkSword chain.
2. Treat your phone as compromised by default if you stored seed phrases or private keys in Notes, screenshots, cloud backups, or messaging apps. Move funds to wallets whose seeds were never exposed digitally and rotate exchange passwords and 2FA.
3. Harden your routine: avoid unknown links and pop ups, consider Lockdown Mode if you are a high value target, use hardware wallets for significant balances, and keep 2FA on a separate device where possible, as recommended in broader iPhone security guidance for crypto users from Yahoo Finance.

Conclusion

The DarkSword and Ghostblade toolkit shows how powerful, web based exploits can turn a normal iPhone into a one click siphon for crypto wallet data. For crypto users, the real defense is not hoping malware never hits, but assuming it might and limiting what secrets a compromised phone can reveal by updating quickly, moving large balances to hardware wallets, and keeping recovery phrases entirely offline.