DarkSword (iOS Safari zero-click exploit chain targeting crypto wallets)
Last changed 2026-11-02 · Fact-check review — Fact-check review (verdict: approve): the reviewer checked the page's claims against its sources; the judge moved the trust score from 0 to 3. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·3oHxKq…rJxRSummary
DarkSword is an iOS exploit chain, publicly disclosed in March 2026 by Google's Threat Intelligence Group (GTIG) and the mobile security firms Lookout and iVerify, that chains six vulnerabilities in Safari, WebKit/JavaScriptCore and the iOS kernel to fully compromise iPhones running iOS 18.4 through 18.7 after a visit to a malicious or compromised webpage. Multiple unrelated operators, including a suspected Russian espionage cluster and a Turkish commercial surveillance vendor, deployed it against targets in Saudi Arabia, Turkey, Malaysia and Ukraine, and its data-theft modules are documented by Google itself as collecting cryptocurrency wallet data; later reporting through October 2026 describes the leaked exploit kit being adapted specifically to steal data from named wallet apps such as MetaMask, Phantom, Trust Wallet, imToken, TokenPocket and TronLink. No outlet reviewed has published a confirmed, quantified case of cryptocurrency actually stolen through DarkSword; coverage consistently uses cautious language about wallet-data exposure rather than confirmed theft.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Timeline(8 events)
November 2025
GTIG's tracking of DarkSword use by multiple distinct operators begins; the first observed campaign (UNC6748) targets Saudi Arabian users via a Snapchat-themed lookalike site.
Google Cloud Threat Intelligence Group18 March 2026
GTIG publishes 'The Proliferation of DarkSword,' publicly disclosing the six-vulnerability iOS exploit chain and naming three actor clusters; Lookout and BleepingComputer publish coordinated coverage the same day.
Google Cloud Threat Intelligence Group19 March 2026
Malwarebytes publishes its own analysis of DarkSword, describing wallet- and exchange-app targeting by the Ghostblade data-stealer module.
Malwarebytes1 April 2026
Apple expands the iOS 18.7.7 / iPadOS 18.7.7 security update to a broader set of older devices, including some unable to run iOS 26 and some capable of updating to iOS 26 that had not done so.
TechCrunchJuly 2026
A GitHub project called DarkSword-PROV2, built on leaked DarkSword code, packages the exploit chain into a more complete attack kit, per later SlowMist-sourced reporting.
BlockTempoSeptember 2026
Attacker-controlled infrastructure built on the leaked/packaged DarkSword code goes live, described by SlowMist as occurring in late September 2026; Censys separately identifies DarkSword/Coruna deployment directories on exposed servers around this period.
BlockTempo / Macworld (citing Censys)9 October 2026
Macworld reports, citing Censys, that DarkSword and the related Coruna payload remain in use against unpatched iPhones months after Apple's fixes, specifically to mine Photos and Notes for crypto wallet recovery phrases.
Macworld19 October 2026
SlowMist reports a variant of the leaked DarkSword kit with an added module decrypting keystore files for imToken, TokenPocket and TronLink, and attack telemetry (20,187 page visits, 1,187 exploit attempts, 10 successful exploits, 9 exfiltrations) from a 30-day monitoring window.
BlockTempo (citing SlowMist)Decision Log
- slot 464430988 · hash 32BwiBdp2Zmg1sqJqeuUqJmb9RwFyHjZbL8VLXArhv1E
- slot 464430983 · hash DWuCV5erA3sDDZBboc8CQFwsHw3WyYXfqLA89wHCgd9f
- slot 462045603 · hash 65aUgMaK1BeCg3jxP1GvHS3PHmMbVQhDcaS7VNRJVtiu
- slot 462045598 · hash 6xH7bLSL4qQhu1r1mrWjdYBunzBQ1sMUHdUQXHB5h7AY
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 0 of 9 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 9/23/2026, 12:06:47 PM
last updated: 11/2/2026, 8:38:13 AM
5 viewsavoid.net — verified advice for a post-truth world