Google Alerts iOS Users as DarkSword Malware Targets Crypto Wallets

The Google Threat Intelligence Group has issued a critical warning regarding a sophisticated iOS full-chain attack tool named DarkSword. Since November 2025, this malicious framework has been utilized by multiple threat actors to compromise Apple devices and deploy data-stealing payloads. The primary objective of these incursions involves the extraction of sensitive financial information, specifically targeting cryptocurrency wallet data and private credentials.

Mechanism of the DarkSword Exploit

The DarkSword attack chain is a highly advanced technical operation that leverages a sequence of six distinct vulnerabilities to bypass modern security protocols. According to security researchers, the exploit targets iPhones and iPads running iOS versions 18.4 through 18.7. By chaining these flaws together, attackers can gain complete administrative control over the device without the user's knowledge. Full-chain attacks are particularly dangerous as they allow for persistent access and deep system integration for malicious processes.

Impact on Cryptocurrency Security

Once a device is compromised via DarkSword, attackers deploy secondary payloads, such as the GHOSTBLADE malware. This specific program is designed to scan the device for high-value information related to digital assets and decentralized finance (DeFi) applications.

The malware targets the following sensitive data points:

• Private keys and mnemonic recovery phrases (seed phrases).
• Local crypto wallet files and cached account information.
• Historical transaction records and portfolio balances.
• Authentication tokens for major centralized exchanges and Web3 platforms.

"This attack chain can target iOS 18.4–18.7, utilizing 6 vulnerabilities to achieve full device control and deploy various malicious programs", the report states.

Mitigation and Protective Measures

While the vulnerabilities identified in the DarkSword chain have been addressed by Apple in recent patches, the reuse of the tool by various entities suggests a persistent threat to the ecosystem. Security experts emphasize that users who remain on older software versions are at significant risk of total asset loss. The cryptocurrency community is often a primary target for such exploits due to the irreversible nature of blockchain transactions.

To ensure the safety of digital assets, users are advised to verify that their devices are running the latest security updates. For high-profile individuals or those holding significant amounts of capital, Google recommends enabling Lockdown Mode, an extreme protection feature that limits certain device functionalities to reduce the attack surface. Additionally, the use of hardware wallets remains a standard recommendation for isolating private keys from the internet-connected environment of a mobile device.