{"investigation":{"slug":"darksword-ios-safari-zero-click-exploit-chain-targeting-crypto-wallets","entity_name":"DarkSword (iOS Safari zero-click exploit chain targeting crypto wallets)","trust_score":3,"severity_base":null,"score_modifier":-9,"confidence":0.68,"status":"published","content_type":"investigation","summary":"DarkSword is an iOS exploit chain, publicly disclosed in March 2026 by Google's Threat Intelligence Group (GTIG) and the mobile security firms Lookout and iVerify, that chains six vulnerabilities in Safari, WebKit/JavaScriptCore and the iOS kernel to fully compromise iPhones running iOS 18.4 through 18.7 after a visit to a malicious or compromised webpage. Multiple unrelated operators, including a suspected Russian espionage cluster and a Turkish commercial surveillance vendor, deployed it against targets in Saudi Arabia, Turkey, Malaysia and Ukraine, and its data-theft modules are documented by Google itself as collecting cryptocurrency wallet data; later reporting through October 2026 describes the leaked exploit kit being adapted specifically to steal data from named wallet apps such as MetaMask, Phantom, Trust Wallet, imToken, TokenPocket and TronLink. No outlet reviewed has published a confirmed, quantified case of cryptocurrency actually stolen through DarkSword; coverage consistently uses cautious language about wallet-data exposure rather than confirmed theft.","sections":[{"content":"DarkSword is the name Google's Threat Intelligence Group (GTIG) gave to an iOS exploit chain described in a GTIG blog post, 'The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors,' published March 18, 2026. GTIG states the chain 'supports iOS versions 18.4 through 18.7 and utilizes six different vulnerabilities to deploy final-stage payloads.' Mobile security firm Lookout says it discovered DarkSword while investigating infrastructure tied to a separate, earlier exploit chain called Coruna, and published its own analysis the same day; the firm iVerify also analyzed the kit. According to GTIG and Lookout, the attack begins when a victim's iPhone, running Safari, loads a page (often via a hidden iframe on a compromised or lookalike website) that triggers the exploit chain. Sources differ on whether to call this 'zero-click': several outlets, including Malwarebytes and Moonlock, describe it as requiring the victim to visit a site, which is more precisely a 'drive-by' or 'watering hole' attack rather than a true zero-click exploit (which would require no user interaction, such as opening a malicious message). GTIG's own post does not use the term 'zero-click.' This page uses 'zero-click' only as shorthand for 'no interaction beyond normal browsing,' consistent with how several outlets characterize it, and flags that the underlying mechanism is a web-based drive-by compromise rather than, for example, an exploit delivered through a message a user never opens.","heading":"What DarkSword is and how it was discovered","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain","name":"Google Cloud Threat Intelligence Group, 'The Proliferation of DarkSword'","type":"research","credibility":2},{"url":"https://security.lookout.com/blog/darksword","name":"Lookout, 'A DarkSword Hangs Over...' (Lookout blog)","type":"research","credibility":2},{"url":"https://www.bleepingcomputer.com/news/security/new-darksword-ios-exploit-used-in-infostealer-attack-on-iphones/","name":"BleepingComputer, 'New DarkSword iOS exploit used in infostealer attack on iPhones'","type":"news_article","credibility":2}],"severity":"critical"},{"content":"GTIG's post and The Hacker News both identify six vulnerabilities used by DarkSword: CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520. Per GTIG's own vulnerability table, three of the six, CVE-2026-20700, CVE-2025-43529 and CVE-2025-14174, were exploited as zero-days before Apple patched them. The Hacker News describes the flaws as covering JavaScriptCore memory corruption, a dyld user-mode PAC bypass, an ANGLE memory-corruption bug, and iOS kernel memory-management issues, used in sequence to escalate from code execution inside Safari to a full sandbox escape and kernel-level compromise. BleepingComputer reports that a central JavaScript orchestrator, referred to in reporting as pe_main.js, then injects further code into privileged iOS system processes (cited examples include Keychain, Wi-Fi and iCloud-related services) before loading data-theft modules.","heading":"Technical chain and the six CVEs","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain","name":"Google Cloud Threat Intelligence Group, 'The Proliferation of DarkSword'","type":"research","credibility":2},{"url":"https://thehackernews.com/2026/03/darksword-ios-exploit-kit-uses-6-flaws.html","name":"The Hacker News, 'DarkSword iOS Exploit Kit Uses 6 Flaws'","type":"news_article","credibility":2},{"url":"https://www.bleepingcomputer.com/news/security/new-darksword-ios-exploit-used-in-infostealer-attack-on-iphones/","name":"BleepingComputer, 'New DarkSword iOS exploit used in infostealer attack on iPhones'","type":"news_article","credibility":2}],"severity":"high"},{"content":"The actor attributions circulating in secondary coverage, including a Cloud Security Alliance (CSA) research note, originate with Google's Threat Intelligence Group, which the CSA note summarizes and credits as its source ('GTIG attributed the kit's deployment to at least three independent operators'). GTIG's own post states it has tracked DarkSword use by 'multiple commercial surveillance vendors and suspected state-sponsored actors' since at least November 2025, and names three distinct clusters: UNC6748, which targeted Saudi Arabian users via a Snapchat-themed lookalike site and deployed a JavaScript backdoor GTIG calls GHOSTKNIFE; a Turkish commercial surveillance vendor named PARS Defense, whose campaigns in Turkey and Malaysia delivered a backdoor called GHOSTSABER; and UNC6353, which GTIG and the CSA note both describe as a 'suspected' (not confirmed) Russian espionage group, previously linked to the earlier Coruna exploit chain, that incorporated DarkSword into watering-hole attacks on Ukrainian websites and deployed a more limited data-miner GTIG calls GHOSTBLADE. The CSA note explicitly does not attribute UNC6748 to a specific country, describing it instead as 'an unattributed state or state-adjacent actor.' Lookout's own assessment, reported by BleepingComputer, characterizes UNC6353 as 'a Russian threat actor with financial objectives' alongside espionage goals, a framing that is itself an estimate rather than a confirmed government attribution.","heading":"Threat actor attribution","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain","name":"Google Cloud Threat Intelligence Group, 'The Proliferation of DarkSword'","type":"research","credibility":2},{"url":"https://labs.cloudsecurityalliance.org/research/csa-research-note-darksword-ios-fullchain-zeroday-multiactor/","name":"Cloud Security Alliance research note, 'DarkSword: Full-Chain iOS Zero-Day Exploitation by State Actors'","type":"research","credibility":2},{"url":"https://www.bleepingcomputer.com/news/security/new-darksword-ios-exploit-used-in-infostealer-attack-on-iphones/","name":"BleepingComputer, 'New DarkSword iOS exploit used in infostealer attack on iPhones'","type":"news_article","credibility":2}],"severity":"high"},{"content":"GTIG's own disclosure confirms crypto-wallet targeting at the source level: its data table for the GHOSTBLADE payload lists 'Financials and Transactions: Cryptocurrency wallet data' among the categories of information collected. Lookout's and Malwarebytes' analyses of the related Ghostblade data-stealer module both name a near-identical list of targeted wallet and exchange apps: Ledger, Trezor, MetaMask, Exodus, Phantom, Uniswap and Gnosis Safe among wallets, and Coinbase, Binance, Kraken, KuCoin, OKX and MEXC among exchange apps. BleepingComputer's coverage names a shorter illustrative list (Coinbase, Binance, Ledger, 'and others'). Reporting escalated later in 2026: Macworld, citing a Censys report published around October 9, 2026, states that DarkSword, used together with the earlier Coruna payload, remained active against unpatched devices and that the combined toolset 'mines Photos and Notes for BIP39 recovery phrases' while targeting Bitpie, Coinbase, Exodus, imToken, MetaMask, Phantom, Trust Wallet, Uniswap and OKEx. Separately, Taiwanese crypto outlet BlockTempo reported on October 19, 2026 that SlowMist's threat-intelligence team found a variant of the publicly leaked DarkSword code with an added cryptocurrency-wallet module not present in the original, performing keystore decryption specifically for imToken, TokenPocket and TronLink; SlowMist's reporting, per BlockTempo, logged 20,187 page visits, 1,187 exploit attempts, 10 successful exploits and 9 data exfiltrations across 57 devices over a 30-day monitoring window, and advised that any device that visited a suspicious page should treat its seed phrase as potentially exposed. A separately circulated claim that a SlowMist advisory named a specific lure domain could not be verified: no SlowMist primary advisory or secondary outlet repeating that domain name could be located, so it is omitted here as unverifiable. Despite the volume of wallet-app names across sources, no outlet reviewed documents a confirmed, named victim or a specific dollar amount of cryptocurrency actually stolen through DarkSword; the SlowMist, Lookout, Censys and GTIG material all describe wallet-data access or exfiltration capability rather than confirmed theft.","heading":"Targeting of crypto wallets and exchange accounts","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain","name":"Google Cloud Threat Intelligence Group, 'The Proliferation of DarkSword'","type":"research","credibility":2},{"url":"https://security.lookout.com/blog/darksword","name":"Lookout, 'A DarkSword Hangs Over...' (Lookout blog)","type":"research","credibility":2},{"url":"https://www.malwarebytes.com/blog/mobile/2026/03/a-darksword-hangs-over-unpatched-iphones","name":"Malwarebytes, '[updated] A DarkSword hangs over unpatched iPhones'","type":"research","credibility":2},{"url":"https://macworld.com/article/3257479/darksword-and-coruna-ios-exploits-continue-to-attack-crypto-wallets.html","name":"Macworld, 'DarkSword and Coruna iOS exploits continue to attack crypto wallets'","type":"news_article","credibility":2},{"url":"https://www.blocktempo.com/?p=547791","name":"BlockTempo, SlowMist DarkSword wallet-theft module report","type":"news_article","credibility":2}],"severity":"critical"},{"content":"GTIG states Apple had patched all six DarkSword vulnerabilities by iOS 26.3. On April 1, 2026, Apple released iOS 18.7.7 and iPadOS 18.7.7 more broadly; TechCrunch, reporting the same day, states that Apple 'has also released a new update to iOS 18 users with iPhones and iPads that are unable to run iOS 26 software,' while separately noting the update also reaches 'the millions of users with unpatched devices that are capable of updating to iOS 26 but who have chosen not to update.' TechCrunch's reporting therefore supports both rationales: the backport covers devices that cannot run iOS 26 at all, and it also benefits users who could update to iOS 26 but had not done so. Malwarebytes similarly reports that 'Apple expanded the \"DarkSword\" patches to iOS 18.7.7 on April 1st, 2026,' in an April 2, 2026 update to its March 19, 2026 article. Sources vary on exactly which version number marks full protection, with the CSA research note citing iOS 18.7.6 or iOS 26.3.1 as Apple's recommended minimum and GTIG's own post citing iOS 26.3. Apple is also reported to have issued fixes for older platform branches (iOS 15.8.7 and iOS 17.6.15 were named in some coverage) to cover devices that cannot run iOS 18 or 26 at all. GTIG recommends enabling Lockdown Mode on devices that cannot be updated, stating it disables web technologies the exploit chain relies on.","heading":"Apple's patches and the iOS 18.7.7 backport","sources":[{"url":"https://techcrunch.com/2026/04/01/apple-releases-security-fix-for-older-iphones-and-ipads-to-protect-against-darksword-attacks","name":"TechCrunch, 'Apple releases security fix for older iPhones and iPads to protect against DarkSword attacks'","type":"news_article","credibility":1},{"url":"https://www.malwarebytes.com/blog/mobile/2026/03/a-darksword-hangs-over-unpatched-iphones","name":"Malwarebytes, '[updated] A DarkSword hangs over unpatched iPhones'","type":"research","credibility":2},{"url":"https://labs.cloudsecurityalliance.org/research/csa-research-note-darksword-ios-fullchain-zeroday-multiactor/","name":"Cloud Security Alliance research note, 'DarkSword: Full-Chain iOS Zero-Day Exploitation by State Actors'","type":"research","credibility":2},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain","name":"Google Cloud Threat Intelligence Group, 'The Proliferation of DarkSword'","type":"research","credibility":2}],"severity":"medium"},{"content":"Following the March 2026 disclosure, portions of the DarkSword exploit kit were leaked publicly; TechCrunch reports 'a researcher posted the DarkSword kit on GitHub, making it available to threat actors targeting older iPhones,' and Apple estimated at the time that roughly a quarter of active iPhones and iPads, described as hundreds of millions of devices, remained on vulnerable iOS versions. BlockTempo's October 2026 reporting states that by July 2026 a GitHub project called DarkSword-PROV2 had packaged the leaked code into a more complete attack kit, and that SlowMist observed attacker-controlled infrastructure built on this code go live in late September 2026, with an added wallet-theft module not present in the original leak. Macworld's October 9, 2026 report, citing Censys, states the toolset (used together with the earlier Coruna exploit) continued to operate against iPhones running iOS 26.2 and earlier months after Apple's patches, underscoring that unpatched devices remained exposed well after fixes were available. These later reports indicate DarkSword evolved from a set of actor-specific intrusions documented by GTIG in March 2026 into a more widely available, commodified attack kit by the second half of 2026.","heading":"Public leak and continued exploitation through late 2026","sources":[{"url":"https://techcrunch.com/2026/04/01/apple-releases-security-fix-for-older-iphones-and-ipads-to-protect-against-darksword-attacks","name":"TechCrunch, 'Apple releases security fix for older iPhones and iPads to protect against DarkSword attacks'","type":"news_article","credibility":1},{"url":"https://macworld.com/article/3257479/darksword-and-coruna-ios-exploits-continue-to-attack-crypto-wallets.html","name":"Macworld, 'DarkSword and Coruna iOS exploits continue to attack crypto wallets'","type":"news_article","credibility":2},{"url":"https://www.blocktempo.com/?p=547791","name":"BlockTempo, SlowMist DarkSword wallet-theft module report","type":"news_article","credibility":2}],"severity":"high"}],"timeline":[{"date":"2025-11","event":"GTIG's tracking of DarkSword use by multiple distinct operators begins; the first observed campaign (UNC6748) targets Saudi Arabian users via a Snapchat-themed lookalike site.","source":"Google Cloud Threat Intelligence Group","source_url":"https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain"},{"date":"2026-03-18","event":"GTIG publishes 'The Proliferation of DarkSword,' publicly disclosing the six-vulnerability iOS exploit chain and naming three actor clusters; Lookout and BleepingComputer publish coordinated coverage the same day.","source":"Google Cloud Threat Intelligence Group","source_url":"https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain","date_evidence":"March 18, 2026"},{"date":"2026-03-19","event":"Malwarebytes publishes its own analysis of DarkSword, describing wallet- and exchange-app targeting by the Ghostblade data-stealer module.","source":"Malwarebytes","source_url":"https://www.malwarebytes.com/blog/mobile/2026/03/a-darksword-hangs-over-unpatched-iphones","date_evidence":"by Pieter Arntz | March 19, 2026"},{"date":"2026-04-01","event":"Apple expands the iOS 18.7.7 / iPadOS 18.7.7 security update to a broader set of older devices, including some unable to run iOS 26 and some capable of updating to iOS 26 that had not done so.","source":"TechCrunch","source_url":"https://techcrunch.com/2026/04/01/apple-releases-security-fix-for-older-iphones-and-ipads-to-protect-against-darksword-attacks","date_evidence":"12:02 PM PDT · April 1, 2026"},{"date":"2026-07","event":"A GitHub project called DarkSword-PROV2, built on leaked DarkSword code, packages the exploit chain into a more complete attack kit, per later SlowMist-sourced reporting.","source":"BlockTempo","source_url":"https://www.blocktempo.com/?p=547791"},{"date":"2026-09","event":"Attacker-controlled infrastructure built on the leaked/packaged DarkSword code goes live, described by SlowMist as occurring in late September 2026; Censys separately identifies DarkSword/Coruna deployment directories on exposed servers around this period.","source":"BlockTempo / Macworld (citing Censys)","source_url":"https://www.blocktempo.com/?p=547791"},{"date":"2026-10-09","event":"Macworld reports, citing Censys, that DarkSword and the related Coruna payload remain in use against unpatched iPhones months after Apple's fixes, specifically to mine Photos and Notes for crypto wallet recovery phrases.","source":"Macworld","source_url":"https://macworld.com/article/3257479/darksword-and-coruna-ios-exploits-continue-to-attack-crypto-wallets.html","date_evidence":"Oct 9, 2026"},{"date":"2026-10-19","event":"SlowMist reports a variant of the leaked DarkSword kit with an added module decrypting keystore files for imToken, TokenPocket and TronLink, and attack telemetry (20,187 page visits, 1,187 exploit attempts, 10 successful exploits, 9 exfiltrations) from a 30-day monitoring window.","source":"BlockTempo (citing SlowMist)","source_url":"https://www.blocktempo.com/?p=547791","date_evidence":"2026-10-19 20:11"}],"sources_used":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain","name":"Google Cloud Threat Intelligence Group, 'The Proliferation of DarkSword'","type":"research","credibility":2},{"url":"https://security.lookout.com/blog/darksword","name":"Lookout, 'A DarkSword Hangs Over...' (Lookout blog)","type":"research","credibility":2},{"url":"https://www.bleepingcomputer.com/news/security/new-darksword-ios-exploit-used-in-infostealer-attack-on-iphones/","name":"BleepingComputer, 'New DarkSword iOS exploit used in infostealer attack on iPhones'","type":"news_article","credibility":2},{"url":"https://www.malwarebytes.com/blog/mobile/2026/03/a-darksword-hangs-over-unpatched-iphones","name":"Malwarebytes, '[updated] A DarkSword hangs over unpatched iPhones'","type":"research","credibility":2},{"url":"https://techcrunch.com/2026/04/01/apple-releases-security-fix-for-older-iphones-and-ipads-to-protect-against-darksword-attacks","name":"TechCrunch, 'Apple releases security fix for older iPhones and iPads to protect against DarkSword attacks'","type":"news_article","credibility":1},{"url":"https://thehackernews.com/2026/03/darksword-ios-exploit-kit-uses-6-flaws.html","name":"The Hacker News, 'DarkSword iOS Exploit Kit Uses 6 Flaws'","type":"news_article","credibility":2},{"url":"https://labs.cloudsecurityalliance.org/research/csa-research-note-darksword-ios-fullchain-zeroday-multiactor/","name":"Cloud Security Alliance research note, 'DarkSword: Full-Chain iOS Zero-Day Exploitation by State Actors'","type":"research","credibility":2},{"url":"https://macworld.com/article/3257479/darksword-and-coruna-ios-exploits-continue-to-attack-crypto-wallets.html","name":"Macworld, 'DarkSword and Coruna iOS exploits continue to attack crypto wallets'","type":"news_article","credibility":2},{"url":"https://www.blocktempo.com/?p=547791","name":"BlockTempo, SlowMist DarkSword wallet-theft module report","type":"news_article","credibility":2}],"source_tags":[],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-09-23T12:06:47.162395+00:00","updated_at":"2026-11-02T08:38:12.313+00:00"},"source_quality":{"total":9,"tier1":0,"tier2":0,"tier3":0,"unrated":9},"follower_count":null,"content_updated_at":"2026-11-02T08:38:13.325Z","last_fact_checked_at":"2026-11-02T08:38:12.608Z","fact_check_next_allowed_at":"2026-11-09T08:38:12.608Z","update_next_allowed_at":"2026-11-09T04:45:11.981Z"}