Google Discovers iOS Vulnerability Chain DarkSword Targeting Crypto Wallets

According to Google Threat Intelligence Group (GTIG), Google’s threat intelligence team discovered a full exploit chain for iOS named DarkSword, which leverages six vulnerabilities—including multiple zero-days—to achieve complete device compromise. Since November 2025, this exploit has been used by multiple commercial surveillance vendors and suspected state-backed threat actors in attacks targeting users in Saudi Arabia, Turkey, Malaysia, and Ukraine. DarkSword supports iOS versions 18.4 through 18.7. Upon successful exploitation, attackers can deploy three types of malware: GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER—all written in JavaScript—which are capable of stealing communication logs, location history, browser data, and cryptocurrency wallet information, as well as recording audio, taking screenshots, and executing backdoor commands. GTIG reported the vulnerabilities to Apple at the end of 2025, and all have been patched with the release of iOS 26.3. The associated domains have been added to Google Safe Browsing’s blocklist. Users are strongly advised to update to the latest iOS version immediately.