Researchers at Google have uncovered an active iOS exploit chain capable of delivering malware designed to target cryptocurrency applications on vulnerable iPhones. The exploit, known as DarkSword, takes advantage of six distinct vulnerabilities found in devices running iOS versions 18.4 through 18.7. The findings represent a significant threat to mobile users who hold or trade digital assets through their phones.
DarkSword is triggered when a user visits a malicious or compromised website on a vulnerable device. Once the exploit executes, it deploys a JavaScript-based data-stealing tool called Ghostblade. The malware is engineered to locate and extract data from a range of major cryptocurrency platforms and wallet applications.
Ghostblade actively searches for prominent crypto exchange apps including Coinbase, Binance, Kraken, Kucoin, OKX, and MEXC. It also targets popular crypto wallet applications such as Ledger, Trezor, MetaMask, Exodus, Uniswap, Phantom, and Gnosis Safe. Beyond crypto-related apps, the malware simultaneously harvests a broad range of personal data from infected devices.
The data collected by Ghostblade includes SMS and iMessage communications, call history, contacts, Wi-Fi passwords, Safari cookies and browsing history, location data, health data, photos, and saved passwords. Message histories from Telegram and WhatsApp are also targeted. Notably, the malware is built for rapid data extraction rather than prolonged surveillance — once it has gathered available information, it deletes its temporary files and terminates itself.
Multiple threat actors are reported to be deploying DarkSword, spanning commercial spyware vendors and state-backed groups. Campaigns have been observed in Saudi Arabia, where attackers used a fake application designed to resemble Snapchat, and in Ukraine, where compromised websites — including at least one government site — were used as infection vectors. The breadth of actors involved suggests the exploit has been made available across different threat ecosystems.
The discovery adds to a growing pattern of malware campaigns directed at cryptocurrency users. Last year, the Inferno Drainer malware was linked to the theft of approximately $9 million from crypto users over a six-month period. Separately, a campaign was identified in which counterfeit Android smartphones arrived pre-loaded with crypto-stealing malware. Together, these incidents highlight an escalating and diversified threat landscape for digital asset holders across both major mobile platforms.
Originally reported by Decrypt.
