DarkSword iPhone exploit puts crypto wallets at risk, CertiK warns

CertiK has warned that attackers are using a newer version of the DarkSword iOS exploit kit to target crypto wallets on unpatched iPhones, with a malicious Safari page potentially enough to compromise a device. Summary Six vulnerabilities underpin the DarkSword chain documented by Google for iOS 18.4 through 18.7. P7 DarkSword supports wallet scanning, credential collection, and remote commands on compromised phones. Researchers have observed malicious advertisements delivering the malware while users scroll their Instagram feeds. CertiK recommends updating iOS and moving exposed funds to a wallet with a fresh recovery phrase. CertiK, in a Nov. 6 warning, said the attack does not require users to connect a wallet or approve a transaction. Its thread named MetaMask, Trust Wallet, Phantom, Exodus and Coinbase among the applications reportedly targeted, alongside passwords and recovery phrases stored elsewhere on the phone. “Simply opening a malicious site in Safari can be enough: no wallet connection, no signature needed,” the security firm wrote. The warning follows separate investigations into DarkSword’s original exploit chain, an updated spyware variant disclosed in October, and ...