DarkSword iPhone Attack Kit Logs Nine Data Theft Events in 30 Days

A live DarkSword attack kit extracted data from iPhones nine times in a 30-day period, exposing the risk to crypto wallets when vulnerable devices open malicious Safari pages.

SlowMist, a blockchain security firm, matched an active attack server to a public DarkSword-PROV2 package containing exploit code, a delivery server and a control panel. The panel recorded 20,187 page visits, 1,187 exploit attempts and 10 successful exploits during the period. Nine reached the data exfiltration stage.

Opening a malicious page in Safari can trigger the attack without another tap. Wallet functions added to the kit target stored data from imToken, TokenPocket and TronLink.

The kit claims broad iOS coverage, but its complete exploit chain covers iOS 18.6 through 18.7.2 and iOS 26.0 through 26.1. A device listed on the panel may have visited a landing page without being compromised. The original six-vulnerability DarkSword chain was disclosed in March; the packaged version appeared on GitHub in July and was observed online in late September.

Owners of devices that visited suspicious pages should create a new wallet on a device that never opened those pages, move their assets and keep iOS updated.