CertiK has warned iPhone users about DarkSword, an exploit that can steal cryptocurrency wallet credentials through malicious websites. The attack targets vulnerable devices without requiring wallet connections or transaction approvals.
In a November 6 post, the security firm said attackers could use Apple’s Safari browser to access sensitive device information. This includes wallet recovery phrases and saved passwords.
CertiK said DarkSword uses six vulnerabilities to target iPhones running iOS 18.4 through 18.7. The malware can access Apple’s Keychain to extract saved passwords and scan Photos and Apple Notes for wallet recovery phrases.
Affected wallet applications include MetaMask, Trust Wallet, Phantom, Exodus and Coinbase. Switching applications may not protect users because the malware targets information stored on compromised devices.
Separately, an iVerify investigation identified a newer version called P7 DarkSword in August 2026. It improves detection avoidance and data theft while communicating with attacker-controlled servers every 15 seconds.
CertiK warned that other attackers could obtain the exploit kit by purchasing its source code. The firm advised users to update iOS, avoid suspicious links and remove recovery phrases from Notes and Photos.
It also recommended hardware wallets and Apple’s Lockdown Mode for higher-risk users. Anyone suspecting an infection should transfer funds using a clean device, abandon the exposed recovery phrase and create a new one.
