CertiK Warns DarkSword iPhone Exploit Can Steal Crypto Wallet Data Without Transaction Approval
Security firm CertiK has warned that an updated version of the DarkSword iPhone exploit kit can compromise vulnerable devices and expose cryptocurrency wallet information without requiring users to connect their wallets or approve transactions. The attack may begin when an iPhone user simply opens a malicious webpage in Safari.
In an alert published on X on November 6, CertiK said the exploit could target several popular crypto applications, including MetaMask, Trust Wallet, Phantom, Exodus and Coinbase. It may also collect passwords and recovery phrases stored elsewhere on an affected device.
The warning highlights a risk that differs from conventional wallet-draining attacks, which often rely on users signing malicious transactions or granting access to their wallets. DarkSword reportedly exploits weaknesses in the iPhone operating system itself, potentially allowing attackers to access sensitive information directly from a compromised device.
DarkSword Exploits Six iOS Vulnerabilities
The attack chain was documented by Google's Threat Intelligence Group in a report published on March 18. Researchers described six vulnerabilities affecting iOS versions 18.4 through 18.7 that could be combined to compromise vulnerable devices.
Google identified three malware families deployed following successful exploitation: GHOSTBLADE, GHOSTKNIFE and GHOSTSABER. Their capabilities include collecting cryptocurrency wallet information, device keychain data, Notes databases, browser records and personal media.
Google also observed campaigns targeting users in Saudi Arabia, Turkey, Malaysia and Ukraine, with activity dating back to at least November 2025.
Apple addressed the vulnerabilities through security updates, with the fixes available by the release of iOS 26.3. Most of the patches had been delivered earlier, making outdated operating systems a central factor in the reported exposure.
New DarkSword Variants Expand the Threat
The exploit kit has continued to develop. Mobile security company iVerify disclosed a P7 variant of DarkSword in an October 8 report after investigating an infection discovered on a customer's device in August.
According to iVerify, the implant contacts its command server every 15 seconds by default. It also processes keychain information locally before sending data to its operators and includes a dedicated command to identify installed wallet applications and extract information from imToken.
A separate investigation published on October 21 by iVerify and Report URI traced the distribution of DarkSword through malicious advertising. One campaign reportedly used a World Cup-themed Instagram advertisement that infected an employee's device while the person was scrolling through the platform.
The researchers also identified a campaign called DeadTag, which relied on hundreds of re-registered analytics domains. The network associated with those domains was estimated to receive approximately 135 million visits per month.
Another distribution method involved a fake Polymarket webpage that delivered two DarkSword variants. Vulnerable devices could reportedly become infected automatically as the page loaded.
CertiK recommended using hardware wallets to protect significant cryptocurrency holdings and suggested Apple's Lockdown Mode for people facing elevated security risks.
CZ Urges iPhone Users to Update After Reported $5.57 Million Loss
Binance co-founder Changpeng Zhao also urged iPhone users to update their operating systems immediately. In a post on X on Friday, he emphasized that wallet applications cannot fix vulnerabilities in the operating system beneath them and that users managing their own private keys remain responsible for securing their devices.
The warning followed estimates from security researcher Officer's Notes, who said approximately $5.57 million in digital assets had already been stolen through the vulnerability. The reported losses were linked to more than 18 websites hosting malicious code.
Officer's Notes also reported that the exploit kit was being sold online for approximately $30,000. One version reportedly included a module specifically designed to target the imToken wallet.
According to the researcher, iOS 18.6.2 was the last version supported by the DarkSword exploit. This places particular attention on devices that have remained unupdated despite Apple's security fixes.
However, references to iOS 26 and iOS 27 found in the kit's code suggest that its developers may be preparing to target newer operating system versions. Those references do not, by themselves, establish that working exploits for those versions are already available.
Researchers Recommend Software Updates and Safer Wallet Practices
DarkSword is not the only reported iOS security concern involving cryptocurrency users. In September, Apple fixed a vulnerability in its CoreGraphics graphics engine that the company acknowledged may have been exploited in sophisticated attacks against specific individuals.
Separately, security researchers from SlowMist and OKX previously identified malicious code in the FomoPeek application that could access information beyond the app's normal permissions on iOS.
Security recommendations from the researchers include installing the latest available iOS updates through Settings, General and Software Update. Users should also avoid storing wallet recovery phrases in Notes, Photos or screenshots, where malware operating on a compromised device may be able to access them.
Links shared through Telegram groups and direct messages should be treated cautiously, particularly when they lead to unfamiliar websites. The reported fake Polymarket page demonstrates how simply loading a malicious webpage could expose an unpatched device.
For users who believe their phones have already been compromised, the guidance described in the source material is to create a new wallet on an updated device and transfer the remaining funds. The old recovery phrase should not be reused.
The DarkSword reports underline the security risks of keeping wallet credentials on internet-connected smartphones. Updating the operating system, protecting recovery phrases and using hardware-based storage for significant holdings can reduce exposure to attacks targeting the device rather than the wallet application's transaction process.
source: en.coinotag
Writer: Ethan Collins
Crypto Journalist
Ethan Collins reports on developments across the cryptocurrency and blockchain sector. His work covers market movements, protocol updates, regulatory changes, and emerging trends in digital assets.
He focuses on presenting complex topics in a clear and accessible manner for a broad readership.
Check out other news and articles on Google News
Disclaimer:
The articles on Hokanews are here to keep you updated on the latest buzz in crypto, tech, and beyond—but they’re not financial advice. We’re sharing info, trends, and insights, not telling you to buy, sell, or invest. Always do your own homework before making any money moves.
Hokanews isn’t responsible for any losses, gains, or chaos that might happen if you act on what you read here. Investment decisions should come from your own research—and, ideally, guidance from a qualified financial advisor. Remember: crypto and tech move fast, info changes in a blink, and while we aim for accuracy, we can’t promise it’s 100% complete or up-to-date.