- Google researchers identified an iOS exploit chain dubbed DarkSword targeting iPhones running iOS 18.4 through 18.7.
- The exploit deploys Ghostblade Malware to steal data from major crypto exchange and wallet apps like Coinbase, MetaMask, and Ledger.
- Attacks using DarkSword have been observed in Saudi Arabia, Turkey, Malaysia, and Ukraine via compromised websites, including government sites.
Google researchers have discovered an active iOS exploit chain called DarkSword that compromises iPhones running versions 18.4 through 18.7, delivering malware that specifically targets cryptocurrency users. The exploit, leveraging six vulnerabilities, infects devices when users visit malicious or compromised websites.
Consequently, the deployed Ghostblade malware actively seeks out and steals data from major crypto exchange apps such as Coinbase, Binance, Kraken, KuCoin, OKX, and MEXC. It simultaneously hunts for popular crypto wallet applications including Ledger, Trezor, MetaMask, Exodus, Uniswap, Phantom, and Gnosis Safe.
Meanwhile, Ghostblade also exfiltrates SMS and iMessage messages, call history, contacts, Wi-Fi passwords, Safari cookies and browsing history, location data, health data, photos, saved passwords, and message history from Telegram and WhatsApp. Campaigns have been observed in Saudi Arabia using a fake Snapchat lookalike and in Ukraine through compromised websites, including a government site.
However, Ghostblade is designed for quick data theft rather than long-term surveillance, collecting all available data before deleting its temporary files and terminating itself. This is the latest in a wave of malware targeting crypto users, including the Inferno Drainer malware that stole some $9 million last year.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
