SlowMist has issued a cautionary notice indicating that hackers may have altered the Darksword exploit chain to specifically target devices running iOS 26.5, which could lead to the unauthorized extraction of private keys from self-custody cryptocurrency wallets.
Summary
- Darksword attacks can commence when a user on an iPhone clicks on a malicious link in Safari.
- SlowMist reports that attackers may have customized the exploit chain for iOS 26.5.
- Previously, Google confirmed Darksword activity affecting iOS versions 18.4 to 18.7.
- Three U.S. investors have alleged that fraudulent wallet applications led to losses of $1.835 million in Bitcoin.
23pds, the Chief Information Security Officer at SlowMist, stated that attackers are utilizing Darksword to bypass Apple’s security systems, gaining extensive access to compromised iPhones and extracting data from locally stored cryptocurrency wallets.
The reported vulnerability impacting iOS 26.5 has yet to receive independent confirmation from either Apple or Google. Research by Google’s Threat Intelligence Group highlighted Darksword’s effectiveness across iOS versions 18.4 to 18.7, while 23pds indicated that hackers have since modified the tool for the newer operating system.
Darksword may extend to iOS 26.5 devices
Google’s Threat Intelligence Group categorized Darksword as a robust iOS exploit chain, utilizing six vulnerabilities to infiltrate devices and deliver various malicious payloads. The company has monitored related activities from at least December 2025 to March 2026.
Initially, the framework was intended for iOS versions 18.4 to 18.7. A specific vulnerability exploited on iOS 18.6 and 18.7, known as CVE-2025-43529, affected JavaScriptCore, which processes JavaScript in Safari. Apple patched this vulnerability in iOS 18.7.3 and iOS 26.2 following Google’s report.
Recent evaluations by SlowMist suggest that potential vulnerabilities may affect iOS 26.5, though this claim has not been officially validated. The warning did not disclose which specific vulnerabilities or exploits might enable Darksword to compromise the newer version.
According to 23pds, attackers typically execute their campaigns using social engineering strategies. A victim might receive a link through social media, messaging applications, or other channels, and by accessing the page in Safari, the malicious web content attempts to exploit the browser and other iOS components without requiring a conventional app installation.
If the exploit is successful, the attacker may gain root-level access, as noted by 23pds. This access can negate the isolation that usually prevents one application from accessing the files and credentials of another, thereby jeopardizing private keys and wallet information stored on the device.
Malicious Safari links can unveil wallet data
Google has noted several groups using Darksword with varying end-stage payloads rather than relying on a single malware strain. Depending on their objectives, these payloads may capture account details, messages, browsing history, files, location data, saved Wi-Fi credentials, and information related to cryptocurrency wallets.
The security firm has linked different operations to victims situated in Saudi Arabia, Turkey, Malaysia, and Ukraine. Additionally, Google has associated certain activities with commercial surveillance companies and suspected state-sponsored groups while researchers detected signs that financially motivated actors had obtained advanced iPhone exploitation tools.
No consolidated count of victims or confirmed amounts of cryptocurrency stolen via Darksword were included in the information released by SlowMist. The warning primarily emphasized the framework’s potential to access wallet information post-compromise of the device.
A similar method was observed in a previous mobile threat. In March, crypto.news reported on Google’s findings related to Coruna, an exploit kit containing 23 vulnerabilities across five attack sequences. Coruna targeted iPhones operating on iOS versions ranging from 13 to 17.2.1, being able to search files and images for phrases like “backup phrase” and “bank account.”
As per Google researchers, Coruna fingerprinted the visitor’s device before opting for a suitable exploit based on the iPhone model and software version. Some operators hosted the kit on misleading gambling and cryptocurrency websites, leading to a compromise when a victim opened the page.
Recent iOS threats have targeted private keys
Darksword is not the only contemporary security concern affecting cryptocurrency data on Apple devices. On September 19, Binance warned iPhone and iPad users about malicious code found in versions 1.1 and 1.2 of FomoPeek.
Investigations into the app revealed a kernel exploitation framework with eight attack methods, claiming compatibility with iOS versions 12.0 to 18.7.2 and 26.0 through 26.1. The malicious modules were found to breach the iOS sandbox, allowing access to Keychain data, private keys, wallet recovery phrases, account credentials, and files from other applications, as indicated in a report regarding FomoPeek.
Binance advised anyone using the affected versions to delete the app, update their iOS, and avoid reinstalling it. Users managing their own wallets were encouraged to create a new wallet on a secure device and transfer their assets, as simply uninstalling a malicious app would not protect a wallet if its private key or recovery phrase had already been compromised.
Darksword employs a different strategy, as its documented campaigns rely on malicious or compromised websites. Nevertheless, both scenarios aim to circumvent security protocols designed to protect sensitive data stored on an iPhone.
SlowMist urged users to promptly apply mobile operating system updates and to be cautious about opening unsolicited links from unknown sources. Both Google and Apple have stressed the significance of current software updates as essential defenses, especially since Apple has addressed the six vulnerabilities identified in the original Darksword exploit chain.
U.S. investors have also sued Apple over fake wallets
For U.S. cryptocurrency holders, the Darksword alert coincides with a separate legal issue involving counterfeit wallet software discovered in Apple’s official marketplace. Three investors have filed a federal lawsuit asserting that fraudulent applications mimicking the Sparrow Wallet appeared in the App Store, resulting in losses of about $1.835 million in Bitcoin, according to previous court reports.
The plaintiffs’ claims pertain to fake applications rather than a web-based exploit. However, the case primarily centers around the security of Apple’s mobile distribution system and the financial risks that come with trusting software that seems to be a legitimate cryptocurrency wallet.
In another incident, a counterfeit app posing as Ledger Live allegedly drained at least $9.5 million from over 50 victims between April 7 and April 13. Blockchain investigator ZachXBT traced the stolen funds, which originated from Bitcoin, Ethereum, Solana, Tron, and XRP users, to more than 150 KuCoin deposit addresses and a mixing service.
The fake Ledger application prompted users to enter their 24-word recovery phrases during what appeared to be a standard wallet setup process. Apple ultimately removed the app from its listing after one victim reported downloading it while setting up a Ledger device on a new MacBook.
Unlike the Darksword chain, the fraudulent Ledger app didn’t need to breach the operating system’s security systems. Users unknowingly compromised their wallets by inputting their recovery phrases into the counterfeit software, thus granting its operators control over every address derived from those phrases.
