DarkSword Malware Is Used in Attacks Affecting Some iOS 26 Versions

DarkSword-PROV2 is being used in attacks that can expose crypto wallet data on iPhones running iOS 26.0 through 26.1.

Code analysis identified exploitable versions from iOS 18.6 through 18.7.2 and iOS 26.0 through 26.1. The toolkit advertises support for iOS 13 and newer, but the analyzed exploit paths covered those specific ranges.

DarkSword-PROV2 appeared on GitHub in July 2026, and related attack infrastructure was found in use in late September. The toolkit combines exploit delivery with device and data collection, information theft and fund collection.

It can gather Keychain data, files, messages and crypto wallet data, and includes functions to decrypt wallet data and consolidate funds. A malicious webpage opened in Safari may be enough to trigger an attack.

Users should update iOS and avoid untrusted links. Anyone who opened a suspicious page should treat seed phrases and private keys as potentially exposed, create a new wallet on a device that never accessed the page, move assets, and check blockchain transactions and token approvals.