CertiK Warns DarkSword iPhone Exploit Can Drain Crypto Wallets From a Single Website Visit — No Signature Needed
CertiK warned on November 6, 2026 that an upgraded version of the DarkSword iOS exploit kit is being used against crypto wallets on unpatched iPhones — and that simply visiting a malicious page in Safari may be enough: no wallet connection and no transaction signature required. The warning names wallet apps including MetaMask, Trust Wallet, Phantom, Exodus and Coinbase, plus passwords and recovery phrases stored on the device.
How DarkSword works
DarkSword is an exploit chain of six vulnerabilities affecting iOS versions 18.4 through 18.7, documented by Google's Threat Intelligence Group in March 2026 working with Lookout and iVerify. The upgraded variant, attributed in reporting to the P7/DarkSword tooling, enables wallet scanning, credential stealing and remote command execution on a compromised device. Researchers have observed malicious advertisements injecting the malware while users browse Instagram, turning a normal feed scroll into the first step of the attack. Post-exploitation malware families identified in the research include GHOSTBLADE, GHOSTKNIFE and GHOSTSABER, with activity traced back to at least November 2025.
What is proven — and what is not
Precision matters here. Separately, blockchain data firm Bitquery counted at least $4.06 million taken from 365 TRON wallets between October 5 and November 4, 2026. Bitquery's own report is explicit that its data cannot show whether DarkSword caused those losses, and no source reviewed claims the link is proven — CertiK did not attribute the TRON drains to DarkSword either. What is established is narrower and still serious: the exploit kit is real, the vulnerabilities were real (Google says it reported them to Apple in late 2025 and all six were patched by iOS 26.3, most earlier), and security firms are actively warning that unpatched phones are being targeted.
What to do today
- Update iOS now — Settings, General, Software Update — and install the latest version available for your device.
- Never store a seed phrase in Photos, Notes or screenshots — exactly the places this malware can read.
- Avoid unfamiliar links, especially ads and messages pushing urgent wallet actions.
- If a device may have been exposed while unpatched, move funds to a fresh wallet with a new recovery phrase created on a clean, updated device, as CertiK advises.
The lesson generalises beyond one exploit kit: the phone in your pocket is now part of your wallet's security model, and its patch level matters as much as your seed phrase storage. Our guides to seed phrase phishing and cold storage cover the other two layers. Follow security coverage on the Zimbuck News page and in the Zimbuck Market News group.
Source: CertiK DarkSword warning coverage.
FAQ
What is DarkSword? An iOS exploit kit chaining six vulnerabilities in iOS 18.4–18.7 that can scan wallets, steal credentials and run commands on a compromised iPhone.
Do I have to sign anything for it to work? No — CertiK warns a malicious Safari page visit can be enough, with no wallet connection or signature.
Am I safe if I updated iOS? The six flaws were patched by iOS 26.3 (most earlier), so staying current removes this chain — update promptly.
Did DarkSword steal the $4.06 million from TRON wallets? Not proven. Bitquery counted the losses but says its data cannot link them to DarkSword.
This article is market news and general information only, not financial advice. Join the conversation on Zimbuck — the finance social platform for traders and investors: https://zimbuck.com
