Google Discovers iOS Vulnerability Chain DarkSword That Can Steal Cryptocurrency Wallet Data

DeepFlowTech · 2026-03-20T11:54:43+00:00

Google's threat intelligence team discovered an iOS exploit chain called DarkSword that leverages 6 vulnerabilities to achieve complete device control. Since 2025, the attack has targeted users in Saudi Arabia, Turkey, and other countries, with attackers able to deploy various types of malware and steal sensitive information. iOS 26.3 has patched the related vulnerabilities, and users are advised to upgrade to the latest system.

DeepFlowTech

2026-03-20 11:54:43

Abstract generation in progress

Deep Tide TechFlow News, March 20 — According to Google Threat Intelligence Group (GTIG), Google’s threat intelligence team has discovered a full exploit chain for iOS called DarkSword, which leverages six vulnerabilities (including multiple zero-day exploits) to gain complete control of devices. Since November 2025, it has been used by several commercial surveillance vendors and suspected state-sponsored threat actors to target users in Saudi Arabia, Turkey, Malaysia, and Ukraine.

DarkSword supports iOS versions 18.4 to 18.7. Upon successful intrusion, attackers can deploy three types of malware: GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER, all written in JavaScript. These malware can steal communication records, location history, browser data, and cryptocurrency wallet information, as well as record audio, take screenshots, and execute backdoor commands.

GTIG reported the related vulnerabilities to Apple by the end of 2025, and all have been patched in iOS 26.3. The associated domains have been added to Google’s Safe Browsing protection list. Users are advised to immediately update to the latest version of iOS.

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.