Treat such code as a reason to follow security advisories, not to panic or install exploit tools. Keep the iPhone updated and avoid untrusted developer utilities.
2. Install Security Updates Promptly
Apple’s September 28, 2026, notice for iOS 26.7.1 addressed a CoreGraphics flaw that could allow arbitrary code execution when processing a malicious file. Apple said it was aware of a report that the issue may have been exploited against specific targeted individuals before iOS 27.
Apple did not identify a crypto campaign or wallet theft. However, a compromised phone may expose wallet apps, email, and authentication codes. Install the latest iOS version available for the device, enable automatic updates, and avoid unexpected files or links.
3. Keep Recovery Phrases out of Photos
Kaspersky’s April 2026 SparkCat report found a variant hidden in legitimate-looking apps. Its iOS version scans photo galleries for English-language wallet mnemonic phrases. Researchers found two infected apps in Apple’s App Store and one in Google Play; the malicious code was later removed.
Never photograph, screenshot, or store recovery words in photos, cloud galleries, or message attachments. If a phrase may have been accessed by an untrusted app, treat it as exposed: create a new wallet in a trusted environment and transfer the funds.
4. Verify the Publisher Behind Every Wallet App
Kaspersky identified 26 fraudulent App Store applications impersonating MetaMask, Ledger, Trust Wallet, Coinbase, and other wallets. Their icons and names copied legitimate products; some initially offered unrelated features such as calculators or games. The campaign mainly appeared in the Chinese App Store, where certain official wallets were unavailable.
An App Store listing is not proof of authenticity. Visit the wallet provider’s official website independently and follow its direct store link. Check the developer name and spelling before downloading; never rely on search ranking or a familiar logo.
5. Refuse Unknown Profiles and Seed-Phrase Prompts
Kaspersky’s FakeWallet technical report explains how counterfeit listings redirected users to imitation App Store pages and urged them to install developer profiles. Those profiles enabled trojanized wallet apps to be installed outside the normal store process. The malware could intercept wallet recovery and creation screens to capture users’ recovery phrases, potentially giving attackers access to their funds.
These two Kaspersky reports describe the same broader campaign from different angles, not two unrelated outbreaks. Never install a profile or enterprise certificate to obtain a wallet. Reject any “security check” asking for your recovery phrase.
Follow us on X for real-time crypto updates.
6. Keep Sensitive Data out of Notes and QR Images
Google’s March 2026 Coruna investigation identified five iOS exploit chains containing 23 exploits. Its financial payload could decode QR codes in images and search Apple Memos for BIP39 word sequences or phrases such as “backup phrase.” It also targeted information from numerous crypto wallet apps.
Do not store seed phrases, private keys, or backup QR codes in Notes or image folders. Keep recovery material offline in a secure physical location. Google said Coruna did not work against the latest iOS version and advised updating or enabling Lockdown Mode if an update was not possible.
7. Protect the Whole Phone, Not Only the Wallet
Google’s March 18 DarkSword report described an iOS exploit chain using six vulnerabilities against devices running iOS 18.4–18.7. Its malware could collect cryptocurrency wallet data, messages, contacts, photos, files, and browsing history. Google identified campaigns targeting users in Saudi Arabia, Turkey, Malaysia, and Ukraine.
A compromised phone can expose more than one wallet. Update iOS, avoid suspicious websites, and consider Lockdown Mode when facing elevated targeting risks. Google said the vulnerabilities were patched by iOS 26.3, with most fixed earlier.
8. Do Not Treat an Old iPhone As Cold Storage
OneKey founder Yishi Wang warned against keeping recovery phrases on older iPhones, even when devices are wiped or disconnected. The November 1 report discussed hardware-level vulnerabilities affecting older models. It also noted that exploitation requires physical access and specialized equipment; these flaws do not automatically reveal every stored seed phrase.
Airplane mode does not turn a phone into a hardware wallet. Avoid using an old iPhone as the sole vault for recovery words. If a seed may be exposed, generate a fresh one in a trusted environment and move the assets.
9. Verify Transactions on a Separate Hardware Screen
A July 2026 report quoted Trezor’s chief commercial officer defending hardware wallets as a strong self-custody option for most users. He pointed to the separate screen, which lets users check transaction details before signing, while noting that high-value holders may need layered arrangements.
Hardware wallets are not invulnerable. Buy through trusted channels, verify the full address and amount on the device screen, protect the recovery backup, and keep firmware current. Separate long-term holdings from everyday spending where practical.
10. Check the Full Address Before Sending Funds
Microsoft’s June 2026 investigation examined a Windows-based crypto clipper that monitored clipboard data, stole seed phrases and private keys, and replaced copied wallet addresses. It also spread through infected USB shortcuts and used Tor for command-and-control. This was not an iPhone malware campaign, but it exposes a transfer risk across connected devices
Before sending, compare the complete destination address with trusted recipient details. Do not rely only on the first and last characters. For large transfers, send a small test amount and confirm receipt first.
Overall, the cases expose three weaknesses: exposed recovery phrases, deceptive downloads, and unchecked transactions. iPhone security requires more than an app password. Keep software current, verify wallet sources, store backups offline, and confirm transactions on a trusted screen. No single setting or device replaces these habits.
FAQs
1. Is worse_query actively stealing cryptocurrency from iPhones?
No. Its GitHub documentation describes it as a developer proof of concept that is not useful by itself. Its publication does not establish an active wallet-theft campaign.
2. Can an iPhone photo expose a crypto recovery phrase?
Yes. Kaspersky identified a SparkCat variant that scans photo galleries for wallet mnemonic phrases. Avoid saving seed phrases in screenshots, photographs, or cloud-synced images.
3. Are cryptocurrency wallet apps on Apple’s App Store always safe?
No. Kaspersky identified 26 fraudulent listings impersonating established wallet brands. Verify the publisher through the wallet provider’s official website before installing an app.
4. Does airplane mode make an old iPhone a secure cold wallet?
No. Disconnecting a device does not eliminate hardware vulnerabilities or physical-access risks. An old phone should not be the only place holding recovery credentials.
5. What should users do after entering a seed phrase into a suspicious wallet app?
Treat the phrase as compromised. Create a new wallet with a fresh recovery phrase in a trusted environment, then transfer funds to its addresses. Never reuse the exposed phrase.
Subscribe to our YouTube channel for the latest crypto news.
Related: Scottish Court Jails Three Men Over £2M Cryptocurrency Theft Plot
coinedition.com
