Web3 security firm CertiK issued an urgent warning on November 6, 2026, regarding the DarkSword exploit kit. A new variant of this iOS exploit kit is actively targeting crypto wallets on iPhones that have not updated their operating system.
DarkSword attacks do not require wallet connections or transaction signature approvals from asset owners. A victim’s device can be infected simply by opening a malicious link or website through the Safari browser.
Major mobile crypto wallet apps reported to be targets for data extraction include MetaMask, Trust Wallet, Phantom, Exodus, Coinbase Wallet, and imToken. In addition to wallet apps, passwords and recovery phrases (seed phrases) stored within the phone’s system are also targeted. The data extraction operation is powered by a chain of system vulnerabilities working in tandem.
How the Attack Penetrates Safari
The DarkSword exploit chain was previously documented by Google Threat Intelligence Group on iOS versions 18.4 through 18.7. Research findings revealed a chain of six security vulnerabilities combined to deploy three malware families: GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER.
The GHOSTBLADE malware is tasked with extracting crypto wallet data, Apple Notes databases, keychain databases, chat message records, and victims’ browser history. Traces of the GHOSTBLADE attack campaign were detected targeting users in four countries: Saudi Arabia, Turkey, Malaysia, and Ukraine.
Mobile security firm iVerify identified a newer P7 variant in October 2026 designed to be more stealthy. The P7 variant processes the keychain database directly on the device before transmitting data, while routinely checking the attacker’s server for instructions every 15 seconds.
DeadTag Distribution and User Protection
The distribution of the exploit payload was uncovered through a joint investigation by iVerify and Report URI into the DeadTag distribution campaign. This campaign exploited hundreds of expired domains belonging to web analytics and advertising providers to redirect victims to the exploit payload.
Those expired domains were estimated to garner up to 135 million monthly visits. Attackers capitalized on this massive traffic volume to route users directly to the DarkSword exploit payload.
iPhone users are now urged to immediately update their operating system to the latest version, which patches all known vulnerabilities. Beyond software updates, crypto asset owners are advised to avoid storing recovery phrases or private keys in default notes apps on their phones.
Reported by crypto.news.
Read also: Gnosis Pay Card System Breached with CVVs Leaked - Management Assures User Funds Are Safe
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
