Critical Warning for Those Who Trade Cryptocurrency on Their Phones: Be Sure to Make This Security Update

The DarkSword attack tool, which targets security vulnerabilities in Apple’s iOS operating system, continues to pose a serious threat to cryptocurrency investors. According to recent allegations, a total of $5.57 million worth of assets were stolen from users’ cryptocurrency wallets, particularly in attacks carried out via websites.

DarkSword, previously identified by cybersecurity researchers, allows attackers to compromise iPhones simply by having users visit a website containing malicious code via Safari. Using this method, attackers aim to access users’ passwords, messages, photos, and sensitive files related to cryptocurrency wallets.

Private keys and recovery words (seed phrases) of wallets are particularly among the primary targets of attackers. Obtaining this information can lead to users’ cryptocurrency assets being transferred to other addresses.

DarkSword’s Source Code Allegedly Sold for $30,000

According to the information that has emerged, the source code for DarkSword is being offered for sale on illegal online marketplaces for $30,000. The support table shared by the seller indicates that the most current operating system version targeted by the attack tool is iOS 18.6.2.

However, researchers identified code snippets in the attack infrastructure indicating preparations for iOS 26 and iOS 27 versions as well. This, however, does not necessarily mean that those versions can be compromised with the current tool.

It is reported that the attackers attempted to adapt older DarkSword code to newer iOS versions using artificial intelligence, but the majority of the versions examined did not work.

Google’s previously published technical analysis revealed that DarkSword exploited six different vulnerabilities. Apple patched all of the vulnerabilities used in the known attack chain with subsequent security updates.

However, according to researchers, if attackers find new vulnerabilities that could target current iPhone models, existing malicious code that scans cryptocurrency wallets could be reused.

Indeed, improvements continue to be made to different versions of DarkSword. One of these reportedly includes a separate function targeting data from the popular cryptocurrency wallet imToken.

Millions of Internet Users at Potential Risk

According to the researchers’ analysis, the internet traffic infrastructure that could be used to distribute malicious code is linked to sites that receive approximately 135 million visits per month.

This raises concerns that if attackers gain access to a new vulnerability that can exploit current iOS versions, they could expand their attacks to a wider audience.

Security experts recommend that cryptocurrency investors, in particular, upgrade their iPhones to the latest supported iOS version. They also add that cryptocurrency wallet recovery words should not be stored in photo galleries, screenshots, or the Notes app.

*This is not investment advice.