CertiK Warning: DarkSword iPhone Vulnerability exploits are now targeting encrypted wallets

CertiK warns that attackers are exploiting a relatively new version of the DarkSword iOS vulnerability exploit toolkit, targeting encrypted wallets on unpatched iPhone; a single malicious Safari page may be sufficient to compromise a device.

• The DarkSword attack chain recorded by Google is based on six vulnerabilities, affecting iOS from versions 18.4 to 18.7.
• P7 Version DarkSword supports scanning wallets, collecting credentials, and executing remote commands on compromised phones.
• Researchers observed that when users browse the Instagram information stream, malicious advertisements deliver this malware.
• CertiK It is recommended to update iOS and transfer the exposed funds to a wallet that uses a completely new recovery phrase.

On November 6, CertiK warned that such attacks do not require users to connect their wallets or approve transactions. The company mentioned in its post that applications such as MetaMask, Trust Wallet, Phantom, Exodus, and Coinbase are allegedly among the targets, in addition to passwords and recovery phrases stored in other locations on the phone.

This security company wrote: "It may be sufficient to simply open a malicious website within Safari; there is no need to connect to a wallet, nor is there a need for signing."

Before this warning was issued, external parties had already conducted investigations into the initial exploit chain of DarkSword, the updated variant of spyware disclosed in October, and the advertising infrastructure used to deliver this software.

DarkSword exploited six vulnerabilities to take control of the vulnerable iPhone

The Threat Intelligence Team recorded an attack chain applicable to iOS from 18.4 to 18.7 in their research on March 18th. By exploiting six vulnerabilities, attackers were able to compromise devices and install software designed to collect sensitive information.

Google identified three families of malware that were delivered after successful exploitation: GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER. Each of them has different capabilities; some support remote commands, while others collect data without needing to be continuously running.

Google indicates that the information collected by GHOSTBLADE includes cryptocurrency wallet data, device keychains, message records, browser information, memo databases, as well as personal media content. Google observes that the relevant activities target individuals from Saudi Arabia, Turkey, Malaysia, and Ukraine, involving commercial monitoring suppliers and actors suspected of state support.

According to Google, these activities can be traced back to November 2025. The company stated that it reported these vulnerabilities to Apple later that same year, and by the time iOS version 26.3 was released, all vulnerabilities had been patched, with most of them having been fixed even earlier.

The discovery described by Google is regarding attacks on vulnerable operating systems, and it does not require victims to obtain authorization through a certain encryption application to access.

P7 Version DarkSword Allows attackers to remotely control data collection

Mobile security company iVerify disclosed a variant of P7 in a report on October 8th, following an investigation into an infection incident that was discovered on a customer's device in August.

Researchers have restored a piece of spyware that has been modified to reduce its traces, improve stability, and support two-way communication with infrastructure controlled by attackers. P7 Some log records were removed, process injection was reduced, and browser storage was utilized to prevent reutilization.

Its command list includes a function for identifying installed wallet applications, as well as another function for extracting wallet-related data from imToken. Other commands will collect data from the Apple Notes database, photos, application files, and device information.

By default, this implantation program checks its server for instructions every 15 seconds, but the operator can modify this interval. The number mentioned in the text describes the frequency at which it requests commands, and it does not imply that there is a fixed schedule for stealing funds or extracting wallet contents.

According to iVerify, unlike earlier versions that sent the keychain database out for processing, P7 processes the keychain information on the phone first before transmitting it.

Malicious ads can be delivered without the need to click on a link. DarkSword

iVerify and Report URI recorded on October 21 a case of delivery through malicious advertisements and integrated with abandoned websites.

In one of the cases, a Instagram advertisement themed around the World Cup infected an employee's device while they were browsing the information stream. Subsequently, another group launched an attack on the same employee through a malicious link carrying another variant of DarkSword.

Report URI traced an activity named DeadTag to a domain name that was previously used by analytics and advertising services but had since expired. The attacker purchased these domain names and used the integrated code still embedded in the websites to redirect visitors.

Researchers have identified hundreds of domain names that have been re-registered and embedded in thousands of websites. These websites receive 135 million visits per month; this traffic estimate covers those sites that may deliver vulnerability exploits when visitors meet the conditions set by the attackers.

The investigation also included a forged Polymarket page, which delivered Coruna and P7 DarkSword. The report stated that infection would occur automatically when malicious content was loaded on vulnerable devices.

CertiK Urges users to change exposed recovery phrases

CertiK It is recommended that iPhone users install available updates through "Settings — General — Software Updates" to avoid clicking on unknown links, and not to save passwords in photos, memos, or screenshots.

Its recommendations also include: using hardware wallets for large positions; enabling Lockdown Mode for users with higher risks. Google also suggests using Lockdown Mode when it is not possible to update the system.

In cases where a compromise is suspected, CertiK instructs users to transfer their funds to a newly created wallet on a clean and updated device, and to never reuse the old mnemonic phrases.

In addition, iVerify recommends changing the passwords stored in the keychains of affected phones.