Security researchers at Slowmist have warned that the Darksword iOS exploit, which targets cryptocurrency wallets on iPhones, has been adapted to affect newer iOS versions, significantly expanding its threat scope.
According to 23pds, Chief Information Security Officer at Slowmist, the exploit combines multiple techniques to allow threat actors to steal private keys and other sensitive data from self-custody crypto wallets. While Google Threat Intelligence Group initially reported the exploit was effective only against iOS versions 18.4 through 18.7, Slowmist disclosed that hackers have modified Darksword to work against more recent iOS versions, including iOS 26.5.
The attack typically begins with social engineering, in which threat actors direct users to visit a compromised link through Safari, Apple's default browser. A single click on the malicious link allows the exploit to gain control of the device, bypass security measures, and obtain root-level access to extract wallet data and private keys stored on the phone.
Users can protect themselves by updating their devices to the latest available iOS software version and avoiding suspicious links shared by unknown accounts on social media and messaging applications.
The warning comes as Apple faces a lawsuit from three investors who lost approximately $1.8 million in Bitcoin after downloading a counterfeit wallet application from the official Apple App Store. The legal action contends that Apple failed to enforce adequate security standards and seeks compensation for the losses incurred.
