Google uncovers Ghostblade malware stealing crypto

TLDR

Google has revealed Ghostblade, a new malware that uses an iOS exploit chain to steal crypto keys and data from vulnerable iPhones, especially those running outdated software.

1. Ghostblade is a JavaScript-based data stealer in the DarkSword exploit suite that targets crypto exchange and wallet apps on iOS.
2. Hundreds of millions of iPhones running older iOS versions were potentially vulnerable before Apple patches, with real-world campaigns already observed.
3. Updating iOS, moving seed phrases off phones, and using hardware wallets are the most effective ways to reduce risk from Ghostblade-style attacks.

Deep Dive

1. How Ghostblade Steals Crypto

Google Threat Intelligence identified Ghostblade as part of the DarkSword exploit chain, a set of browser-delivered attacks on iOS that enable full device compromise and rapid data theft on vulnerable iPhones, according to Google-linked reporting.

Once DarkSword gains control of the device, it can deploy Ghostblade, a JavaScript data stealer that specifically hunts major crypto exchange apps (Coinbase, Binance, Kraken, KuCoin, OKX, MEXC) and wallet apps (Ledger, Trezor, MetaMask, Exodus, Uniswap, Phantom, Gnosis Safe), as detailed in independent analysis.

Ghostblade grabs private keys, authentication tokens, passwords, and broader personal data, then exfiltrates everything to attacker servers, deletes temporary files and crash reports, and shuts down, making it hard to spot with normal usage or performance checks.

2. Who Is Most At Risk

DarkSword has been used against iPhones running iOS 18.4 to 18.7, with Googles research estimating roughly 220270 million devices were potentially exposed before patches, as summarized in a technical breakdown.

Campaigns using this chain were observed in Saudi Arabia, Turkey, Malaysia, and Ukraine, including via compromised government and fake Snapchat-style sites, and involve both commercial spyware vendors and state-linked actors targeting crypto users and other high-value data.

Because Ghostblade also steals SIM data, messages, 2FA codes, and password manager contents, anyone who stores seeds, private keys, or exchange logins on an at-risk iPhone faces a high-impact all keys at once compromise.

3. Practical Protection Steps

Apple has released iOS 26.3 to patch the six vulnerabilities used in DarkSword, and researchers recommend keeping iPhones fully updated and enabling features like Lockdown Mode to reduce exploit surface.

For crypto specifically, stronger practices include: treating phones as hot devices only, keeping meaningful holdings in hardware wallets, and never storing seed phrases in notes, screenshots, cloud backups, or password managers on the same device.

Additional safeguards include using separate devices for large holdings, enabling strong 2FA (preferably hardware keys or offline authenticators), and assuming that if a device may have been hit, all secrets used on it should be rotated and funds moved to fresh wallets.

Conclusion

Ghostblade shows how powerful, browser-based iOS exploits can turn a single click on a malicious site into a full compromise of crypto wallets, exchanges, and personal data. For crypto users, the most effective response is not a specific coin action but tightening device hygiene: keep iOS patched, move long-term funds to hardware or offline setups, and avoid ever letting a phone become the single point of failure for your keys.