CertiK has warned iPhone users about DarkSword, an exploit that can steal cryptocurrency wallet credentials through malicious websites. The attack targets vulnerable devices without requiring wallet connections or transaction approvals.
In a November 6 post on X, the security firm said attackers could use Apple’s Safari browser to access sensitive device information. This includes wallet recovery phrases and saved passwords.
DarkSword Exploits Six iPhone Vulnerabilities
CertiK said DarkSword uses six vulnerabilities to target iPhones running iOS 18.4 through 18.7. The malware can access Apple’s Keychain to extract saved passwords and scan Photos and Apple Notes for wallet recovery phrases.
Related: Gnosis Pay Data Breach Exposes Customer Details, Triggers Security Overhaul
Affected wallet applications include MetaMask, Trust Wallet, Phantom, Exodus and Coinbase. Switching applications may not protect users because the malware targets information stored on compromised devices.
Separately, an iVerify investigation identified a newer version called P7 DarkSword in August 2026. It improves detection avoidance and data theft while communicating with attacker-controlled servers every 15 seconds.
CertiK Urges Users to Update iPhones
CertiK warned that other attackers could obtain the exploit kit by purchasing its source code. The firm advised users to update iOS, avoid suspicious links and remove recovery phrases from Notes and Photos.
It also recommended hardware wallets and Apple’s Lockdown Mode for higher-risk users. Anyone suspecting an infection should transfer funds using a clean device, abandon the exposed recovery phrase and create a new one.
Related: Former FBI Agent Steals $2.47M in Crypto, Exposes 35 Investigations
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
