SlowMist Warned About a DarkSword Attack Targeting iPhone Users’ Crypto Wallets

• The DarkSword exploit allows attackers to gain elevated access to an iPhone via Safari.
• The attack can lead to the compromise of crypto wallet data and private keys.
• SlowMist said the attackers support newer iOS versions, but this information has not yet been independently confirmed.

SlowMist’s chief information security officer, known by the pseudonym 23pds, reported that the DarkSword exploit is being used to attack crypto wallet owners on iPhone.

According to him, attackers are distributing malicious links that victims are prompted to open in Safari. If the vulnerabilities are successfully exploited, the attackers can break out of the browser sandbox, gain elevated privileges, and access device data, including crypto wallet information and private keys.

DarkSword was previously investigated by Google Threat Intelligence Group. Specialists discovered a chain of six vulnerabilities that was used in attacks on users in Saudi Arabia, Turkey, Malaysia, and Ukraine. Google noted support for iOS 18.4 — 18.7 and said the known vulnerabilities had been fixed by the release of iOS 26.3.

SlowMist now claims that attackers have adapted DarkSword for newer versions of the system, including iOS 26.5. 

Experts recommend updating your iPhone to the latest available iOS version and avoiding suspicious links from social networks and messengers.

Earlier, we reported that a crypto trader lost about $600,000 after a fake Cloudflare verification.