Google has recently announced that an advanced iOS exploit chain known as 'DarkSword,' actively exploited since late 2025, has led to attacks on numerous iPhones. Google's Threat Intelligence Group (GTIG) stated that these attacks specifically targeted iOS versions 18.4 and 18.7.
According to GTIG's analysis, DarkSword combines multiple zero-day vulnerabilities, enabling complete device compromise. Among these, the most notable malware, 'GHOSTBLADE,' can leak sensitive information, including cryptocurrency wallet data and user credentials. This poses a significant security risk for crypto asset holders.
Related news: Alert: Massive Bitcoin and Ethereum Options Expire Today – But the Real Shock is Next Week.
Google pointed out that this exploit chain has been active since November 2025 and has been utilized by commercial spyware providers and some organizations believed to be state-sponsored. DarkSword reportedly leverages six different vulnerabilities and activates three distinct malware families upon successful exploitation: GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER. Google also reported that the UNC6353 organization, previously known for using the 'Coruna' iOS exploit toolkit and believed to be linked to Russia, has integrated DarkSword into its new attack campaigns.
Google stated that all identified vulnerabilities were reported to Apple by the end of 2025 and have been fully patched in iOS 26.3. Google also announced that it has added the domains used for attack distribution to its list of safe internet domains.
Google warns users to update their devices to the latest iOS version as soon as possible. If an update is not feasible, it is recommended to enable 'Lockdown Mode' as an additional security measure. Experts note that outdated devices face increasing risks, particularly concerning the theft of cryptocurrency.