SlowMist: "Darksword" exploit now said to hit iOS 26.5, targeting crypto wallet private keys

Sept. 22 (UTC+8) — 23pds, chief information security officer at blockchain security firm SlowMist, said attackers are exploiting the "Darksword" vulnerability to bypass iOS security protections through Safari, take control of devices, and extract private keys and other data from self-custodied crypto wallets, according to ME News. SlowMist said the flaw has previously been linked to campaigns targeting users in Saudi Arabia, Turkey, Malaysia and Ukraine. Google's Threat Intelligence Group had earlier disclosed that "Darksword" initially affected only iOS versions 18.4 to 18.7. 23pds added that the exploit has been adapted to iOS 26.5, though the claim has not been confirmed by official sources. The reported attack chain typically starts with social engineering, prompting victims to click malicious links delivered via social media or messaging apps. If successful, attackers may obtain root access and exfiltrate wallet data. SlowMist urged users to update mobile operating systems promptly and avoid clicking website links sent by unknown contacts. Separately, three investors have sued Apple after losing nearly $1.8 million in Bitcoin allegedly tied to fake wallet apps downloaded from Apple's official App Store. (Source: ChainCatcher)