DarkSword iOS exploit targets crypto wallet apps globally
The latest iOS exploit, called DarkSword, discovered by Google researchers, includes a data stealer targeting popular cryptocurrency wallet apps. The malware has already been detected in several countries, including Saudi Arabia, Turkey, Malaysia, and Ukraine.
Highlights
- DarkSword iOS exploit steals data from crypto wallets.
- Malware targets users in Saudi Arabia, Turkey, Malaysia, Ukraine.
- Experts urge multi-factor authentication and hardware wallet use.
Different countries – similar targets
The Google Threat Intelligence Group (GTIG), a specialized unit analyzing cyber threats, uncovered a chain of iOS exploits called DarkSword, affecting iPhones running iOS versions 18.4 to 18.7.
DarkSword uses six vulnerabilities to deploy malware, including a JavaScript-based data stealer called Ghostblade, which actively targets apps from major cryptocurrency exchanges such as Coinbase, Binance, Kraken, Kucoin, OKX, and MEXC.
It also hunts popular crypto wallet apps including Ledger, Trezor, MetaMask, Exodus, Uniswap, Phantom, and Gnosis Safe, extracting SMS and iMessage messages, stored passwords, call history, contacts, Safari cookies and browsing history, as well as location, health data, photos, and chat histories from Telegram and WhatsApp. Ghostblade is designed for rapid data theft — it collects all available information, deletes temporary files, and terminates.
Enhanced security measures are essential
Experts note that timely detection and user awareness provide significant value: companies and individuals can quickly update devices, enable multi-factor authentication, and use secure wallets for cryptocurrency storage. These measures help minimize potential losses and improve overall cyber resilience.
GTIG highlights that the exploit is used by a wide range of attackers, from commercial spyware vendors to state-backed hacker groups. While in Malaysia and Turkey the malware spread through fake Snapchat apps with commercial motives, in Ukraine government online resources were targeted, with activity linked to the Russian group UNC6353 coordinating with intelligence agencies.
Users are advised to remain vigilant: verify app sources, install iOS updates promptly, enable two-factor authentication, and consider hardware wallets for storing cryptocurrencies.
As we wrote, Google detects iOS exploits targeting crypto wallet seed phrases
-
Afghanistan
-
Albania
-
Algeria
-
Angola
-
Argentina
-
Armenia
-
Australia
-
Austria
-
Azerbaijan
-
Bahamas
-
Bahrain
-
Bangladesh
-
Belarus
-
Belgium
-
Bolivia
-
Botswana
-
Brazil
-
Brunei
-
Bulgaria
-
Cambodia
-
Cameroon
-
Canada
-
Chile
-
China
-
Colombia
-
Congo
-
Costa Rica
-
Cote d'Ivoire
-
Croatia
-
Cuba
-
Cyprus
-
Czechia
-
DR Congo
-
Denmark
-
Dominican Republic
-
Ecuador
-
Egypt
-
El Salvador
-
Estonia
-
Eswatini
-
Ethiopia
-
Finland
-
France
-
Georgia
-
Germany
-
Ghana
-
Greece
-
Haiti
-
Hong Kong
-
Hungary
-
India
-
Indonesia
-
Iran, Islamic republic
-
Iraq
-
Ireland
-
Israel
-
Italy
-
Jamaica
-
Japan
-
Jordan
-
Kazakhstan
-
Kenya
-
Korea
-
Kuwait
-
Kyrgyzstan
-
Laos
-
Latvia
-
Lebanon
-
Lesotho
-
Libya
-
Lithuania
-
Luxembourg
-
Madagascar
-
Malaysia
-
Malta
-
Mauritius
-
Mexico
-
Moldova
-
Mongolia
-
Montenegro
-
Morocco
-
Mozambique
-
Myanmar
-
Namibia
-
Nepal
-
Netherlands
-
New Zealand
-
Nigeria
-
North Macedonia
-
Norway
-
Oman
-
Pakistan
-
Palestine
-
Panama
-
Papua New Guinea
-
Paraguay
-
Peru
-
Philippines
-
Poland
-
Portugal
-
Puerto Rico
-
Qatar
-
Reunion
-
Romania
-
Rwanda
-
Saudi Arabia
-
Serbia
-
Singapore
-
Slovakia
-
Slovenia
-
Somalia
-
South Africa
-
Spain
-
Sri Lanka
-
Sweden
-
Switzerland
-
Syria
-
Taiwan
-
Tajikistan
-
Tanzania
-
Thailand
-
Trinidad and Tobago
-
Tunisia
-
Turkey
-
UAE
-
Uganda
-
Ukraine
-
United Kingdom
-
United States
-
Uruguay
-
Uzbekistan
-
Venezuela
-
Vietnam
-
Yemen
-
Zambia
-
Zimbabwe
- Forex
- Crypto
