An advanced attack chain targeting iPhone users has resurfaced in the news for cryptocurrency investors. Security researchers have revealed that the multi-stage attack chain, dubbed “DarkSword,” which operates via Safari, can progress to full device control on iPhones, allowing attackers to access sensitive data, including cryptocurrency wallets.
According to research published in March by the Google Threat Intelligence Group (GTIG), DarkSword exploits multiple iOS vulnerabilities in a chain, starting with memory corruption flaws in Safari’s JavaScriptCore. The attack can begin when the target user visits a malicious or compromised website through Safari. This then allows bypassing Pointer Authentication Codes (PAC) protection, exiting Safari’s WebContent sandbox environment, and ultimately gaining kernel-level privileges.
Researchers note that if DarkSword is successful, attackers can gain extensive access to the device. Lookout’s research indicates that after an attack, user credentials and sensitive data associated with cryptocurrency wallets can be quickly extracted from the device. This poses a significant risk, particularly for cryptocurrency users who store private keys or recovery phrases on their phones.
The first confirmed versions of DarkSword were found to target devices running iOS 18.4 to iOS 18.7. GTIG stated that six different vulnerabilities were used in the attack chain, and all of these vulnerabilities were patched by Apple with iOS 26.3 at the latest. Researchers also determined that DarkSword was used against targets in Turkey, Saudi Arabia, Malaysia, and Ukraine starting in November 2025.
However, recent claims that the attack works on all iOS versions from iOS 13 to iOS 26.5, or that Apple’s most recent iOS versions are also vulnerable to the same attack chain, have not yet been independently verified. Therefore, this wide version range should not be considered a definitive security finding.
Apple continues to release security updates for iOS. The company released iOS 26.7 on September 14, 2026, and recent iOS updates have also included patches for numerous vulnerabilities affecting WebKit, the kernel, and other system components.
Security researchers recommend that individuals, especially those using cryptocurrency wallets on their phones, update their iPhones and iPads to the latest iOS version. For devices that cannot be updated or are at high risk, enabling Apple’s Lockdown Mode feature is also suggested by GTIG as an additional security measure. Furthermore, it is important for users not to open untrusted links received via messages, emails, or social media in Safari, and not to store critical information such as private keys or mnemonic seed phrases openly on their phones.
