CertiK has warned that attackers are using a newer version of the DarkSword iOS exploit kit to target crypto wallets on unpatched iPhones, with a malicious Safari page potentially enough to compromise a device.
Summary
- Six vulnerabilities underpin the DarkSword chain documented by Google for iOS 18.4 through 18.7.
- P7 DarkSword supports wallet scanning, credential collection, and remote commands on compromised phones.
- Researchers have observed malicious advertisements delivering the malware while users scroll their Instagram feeds.
- CertiK recommends updating iOS and moving exposed funds to a wallet with a fresh recovery phrase.
CertiK, in a Nov. 6 warning, said the attack does not require users to connect a wallet or approve a transaction. Its thread named MetaMask, Trust Wallet, Phantom, Exodus and Coinbase among the applications reportedly targeted, alongside passwords and recovery phrases stored elsewhere on the phone.
“Simply opening a malicious site in Safari can be enough: no wallet connection, no signature needed,” the security firm wrote.
The warning follows separate investigations into DarkSword’s original exploit chain, an updated spyware variant disclosed in October, and advertising infrastructure used to deliver it.
DarkSword uses six flaws to compromise vulnerable iPhones
Google Threat Intelligence Group’s March 18 research documented a chain supporting iOS 18.4 through 18.7. By combining six vulnerabilities, attackers could compromise devices and install software that collected sensitive information.
Google identified three malware families delivered after successful exploitation: GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER. Their capabilities differed, with some supporting remote commands and others collecting data without operating continuously.
Among the information collected by GHOSTBLADE were cryptocurrency wallet data, device keychains, messaging records, browser information, Notes databases, and personal media. Google observed campaigns against people in Saudi Arabia, Turkey, Malaysia and Ukraine, involving commercial surveillance vendors and suspected state-sponsored actors.
The activity dated back to at least November 2025. Google said it reported the vulnerabilities to Apple late that year and that all had been patched by the release of iOS 26.3, with most fixed earlier.
Its findings described attacks against vulnerable operating systems, rather than a requirement for victims to authorize access through a crypto application.
P7 DarkSword gives attackers remote control over data collection
Mobile security firm iVerify disclosed the P7 variant in an Oct. 8 report, following an investigation into an infection detected on a customer’s device in August.
Researchers recovered spyware with changes intended to reduce its footprint, improve stability, and support two-way communication with attacker-controlled infrastructure. P7 removed some logging, reduced process injections, and used browser storage to prevent repeated exploitation.
Its command list included a function to identify installed wallet applications and another to extract wallet-related data from imToken. Other commands collected Apple Notes databases, photos, application files, and device information.
The implant checked its server for instructions every 15 seconds by default, although operators could change that interval. The figure describes how often it requested commands, not a fixed schedule for stealing funds or extracting wallet contents.
Compared with earlier versions that sent a keychain database away for processing, P7 processed keychain information on the phone before transmission, according to iVerify.
Malicious ads have delivered DarkSword without a link click
An Oct. 21 investigation by iVerify and Report URI documented delivery through malicious advertisements and abandoned website integrations.
In one case, a World Cup-themed Instagram advertisement infected an employee’s device while the person scrolled through their feed. A separate group subsequently attacked the same employee through a malicious link carrying another DarkSword variant.
Report URI traced a campaign called DeadTag to expired domains previously used by analytics and advertising services. Attackers bought the domains and used integrations still embedded in websites to redirect visitors.
The researchers identified hundreds of re-registered domains embedded across thousands of sites. Their observed network received 135 million monthly visits, a traffic estimate covering sites capable of serving the exploits when visitors met the attackers’ conditions.
The investigation included a fake Polymarket page delivering both Coruna and P7 DarkSword. The report described automatic infection when malicious content loaded on a vulnerable device.
CertiK urges users to replace exposed recovery phrases
CertiK advised iPhone users to install available updates through Settings, General, and Software Update, avoid unknown links, and keep seed phrases out of Photos, Notes, and screenshots.
Its recommendations included hardware wallets for significant holdings and Lockdown Mode for higher-risk users. Google recommended Lockdown Mode where updating was not possible.
For suspected compromise, CertiK instructed users to move funds to a new wallet created on a clean, updated device and never reuse the old seed phrase.
Separately, iVerify recommended changing passwords stored in the affected phone’s keychain.
