11 mnemonic words, 179 device profiles—DarkSword only requires you to open a webpage to steal your crypto. Network asset mapping company Censys released a report on October 7 confirming that the iOS exploit suite DarkSword is still actively targeting cryptocurrency wallets. Victims don’t need to download anything—simply opening a compromised webpage is enough. The attack chain begins with code execution via WebKit and JavaScriptCore, escapes the browser sandbox, escalates privileges to the kernel, and finally injects into SpringBoard—the system process responsible for managing app launches and the home screen. Once injected, 18 wallet modules take effect—one for each targeted wallet—automatically injecting as soon as the target app launches, including MetaMask, Phantom, Trust Wallet, imToken, and others. This toolset operates like a business. A control panel maintains a roster of 75 accounts, each with assigned commission rates and device quotas; agents have their own distribution channels, and over 60 command whitelists are in place, each requiring secondary confirmation before execution.