Google: DarkSword iOS Malware Targets Crypto Apps on Unpatched iPhones
Google’s security team says the DarkSword exploit chain is being used to install malware on devices running earlier builds of iOS 18, with payloads engineered to locate and compromise cryptocurrency exchange and wallet applications. The report highlights that unpatched iPhones are the primary vector, and that the malware appears tailored to harvest credentials, session tokens or other artifacts that could enable account takeover.
The development matters because targeted compromises of mobile crypto apps can put on‑chain funds and custodial accounts at risk. Users should update to the latest iOS build as a first step, review device access and authentication settings, and follow guidance from their wallet or exchange providers. App teams and custodians should also monitor for anomalous access and coordinate with platform vendors to mitigate further exploitation.