• How the attack works
• Update your iPhone

Ledger Chief Technology Officer Charles Guillemet has warned cryptocurrency holders about a sophisticated iPhone attack that can compromise a victim's device via a malicious page in the Safari browser. 

The warning pertains to DarkSword, an iOS exploit chain that is being used in real-world attacks. 

The malware can break through layers of Apple's security protections before gaining deep access to an iPhone. 

"In plaintext, you visit a website and lose your crypto," Guillemet wrote on X.

He urged users who keep cryptocurrency seed phrases or other sensitive wallet information on an iPhone to reconsider that setup, recommending a hardware wallet and, crucially, updating iOS.

Google Threat Intelligence Group disclosed DarkSword in March. Multiple threat actors have exploited the vulnerability since at least November 2025. 

Researchers identified campaigns targeting users in Saudi Arabia, Turkey, Malaysia, and Ukraine.

The iOS exploit chain can steal sensitive information, including credentials and cryptocurrency wallet data, in a very quick manner. 

How the attack works

A normal website opened in Safari does not have any meaningful access to the rest of an iPhone. Web content is usually isolated within Apple's browser sandbox.

DarkSword gets around those protections by chaining multiple vulnerabilities.

It targets JavaScriptCore, the JavaScript engine used by Safari, to gain control inside the browser process, bypasses Apple's Pointer Authentication Codes, or PAC, a security feature intended to make it much harder for attackers to hijack program execution, and eventually escapes Safari's sandbox. Finally, it exploits the iOS kernel, the core part of the operating system, collecting keychains, messages, contacts, files, location information, and, of course, crypto wallet data. 

Guillemet specifically warned that attackers could use such access to extract wallet information. Keeping a recovery phrase in screenshots, notes, or cloud-synced files is extremely dangerous. 

Update your iPhone

The vulnerabilities in the DarkSword chain disclosed by Google are no longer unpatched zero-days.

Google said all six flaws had been fixed by the release of iOS 26.3. The company urged users to update their devices. 

Meanwhile, Apple has continued shipping additional security fixes since then. Its recent iOS 26.6.1 update, for example, addresses a number of separate WebKit vulnerabilities. 

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。