CertiK warns DarkSword can expose crypto wallets on iPhones

Google’s March 18 research documented six vulnerabilities affecting iOS 18.4 through 18.7. Successful exploitation could install three malware families—GHOSTBLADE, GHOSTKNIFE and GHOSTSABER—with capabilities including data collection and remote commands. GHOSTBLADE could gather wallet data, device keychains, messaging records, browser information, Notes databases and personal media. Google said campaigns targeted people in Saudi Arabia, Turkey, Malaysia and Ukraine, and that all six flaws had been patched by iOS 26.3, with most fixed earlier.

A separate variant, P7 DarkSword, was disclosed by mobile security firm iVerify on Oct. 8 after an infection detected on a customer’s device in August. It can identify installed wallet apps and extract wallet-related data from imToken, as well as collect Notes databases, photos, application files and device information. P7 checked its server for instructions every 15 seconds by default; iVerify clarified that this was a command-request interval, not a schedule for stealing funds.

An Oct. 21 investigation by iVerify and Report URI found that malicious ads and integrations on abandoned websites could deliver DarkSword. In one case, a World Cup-themed Instagram ad infected an employee’s iPhone while they scrolled through the feed. The researchers also traced a campaign using re-registered expired domains embedded across thousands of websites. Those sites received an estimated 135 million visits per month, though the figure covers traffic to sites capable of serving exploits when visitors met the attackers’ conditions.

CertiK advised users to update iOS, avoid unknown links and keep seed phrases out of Photos, Notes and screenshots. It recommended hardware wallets for significant holdings and Lockdown Mode for people at higher risk. Anyone who suspects compromise should move funds to a new wallet created on a clean, updated device and never reuse the old recovery phrase. iVerify separately recommended changing passwords stored in the affected phone’s keychain.