Security firm CertiK has warned that attackers are using an updated version of the DarkSword iOS exploit kit to target cryptocurrency wallets on unpatched iPhones — and simply visiting a malicious webpage in Safari can be enough to compromise a device.
In a warning issued on November 6, CertiK said the attack does not require victims to connect a wallet or approve a transaction. The firm named MetaMask, Trust Wallet, Phantom, Exodus and Coinbase among the applications reportedly targeted, along with passwords and recovery phrases stored elsewhere on the phone.
"Simply opening a malicious site in Safari can be enough: no wallet connection, no signature needed," CertiK wrote. The firm advises iPhone owners to update iOS immediately and move any exposed funds to a wallet with a fresh recovery phrase.
Six flaws behind the DarkSword chain
DarkSword is built on six vulnerabilities affecting iOS 18.4 through 18.7, documented by Google's Threat Intelligence Group in research published on March 18. By chaining the flaws together, attackers can break into a device and install software designed to gather sensitive information.
Google identified three malware families delivered after successful exploitation: GHOSTBLADE, GHOSTKNIFE and GHOSTSABER. GHOSTBLADE gathered data on cryptocurrency wallets, device keychains, messages, browsing information, Notes databases and personal media, while the others could run remote commands.
Google said the campaigns targeted people in Saudi Arabia, Turkey, Malaysia and Ukraine, and involved commercial surveillance vendors and suspected state-sponsored operatives. The activity dates back to at least November 2025. Apple patched all of the flaws by the release of iOS 26.3, with many fixed earlier — leaving only un-updated devices exposed.
Newer P7 variant adds remote control
Mobile security company iVerify disclosed a newer variant, P7 DarkSword, in a report on October 8, after an infection was found on a customer's device in August. The variant was redesigned to shrink its footprint, improve stability and enable two-way communication with attacker-controlled servers.
P7 supports wallet scanning, credential collection and remote commands on compromised phones. It can identify installed wallet applications, extract wallet-related data from imToken, and gather Apple Notes databases, photos, app files and device details. The implant checked in with its server every 15 seconds by default, and processed keychain data directly on the device before sending it out.
Malicious ads spread the exploit
A joint investigation by iVerify and Report URI on October 21 found the malware was delivered through malicious advertisements and neglected website integrations. In one case, a World Cup-themed Instagram advertisement infected an employee's device while they were scrolling through their feed.
Report URI traced a campaign called DeadTag to expired domains previously linked to analytics and advertising services. Attackers repurchased the domains and exploited integrations still present on some websites to redirect visitors. Researchers uncovered hundreds of re-registered domains across thousands of sites, with the monitored network attracting an estimated 135 million monthly visits. A counterfeit Polymarket page also delivered both the Coruna and P7 variants, infecting vulnerable devices automatically once the content loaded.
What iPhone owners should do
CertiK recommends installing available updates through Settings, General and Software Update, avoiding unknown links, and keeping seed phrases out of Photos, Notes and screenshots. It also suggests hardware wallets for significant holdings and Lockdown Mode for users at higher risk.
Anyone who suspects their device may have been compromised should transfer funds to a new wallet created on a secure, updated device, and avoid reusing the old seed phrase. iVerify separately recommends changing passwords stored in the affected device's keychain. CertiK also warned that other attackers could obtain the exploit kit by purchasing its source code.
By Hamza Faisal
