Slowmist Warns Darksword iOS Exploit Targets Crypto Wallet Keys

Slowmist’s chief information security officer, 23pds, has warned that a modified version of the Darksword exploit is now effective against the latest iOS releases, putting self‑custody crypto wallets on iPhones at risk.

Exploit Overview

The Darksword exploit, first identified by Google’s Threat Intelligence Group in March, leverages vulnerabilities in iOS browsers to gain root‑level access. Originally limited to iOS versions 18.4‑18.7, the technique has been adapted to work on iOS 26.5, expanding its reach to a broader user base.

Attack Vector

Threat actors typically use social‑engineering tactics to lure victims to a malicious link opened in Safari, the default iOS browser. A single click can trigger the exploit, allowing attackers to bypass security controls, obtain root permissions, and extract private keys and other wallet data stored on the device.

Geographic Impact

• Saudi Arabia
• Turkey
• Malaysia
• Ukraine

These regions have been cited in earlier campaigns using the original Darksword exploit.

Mitigation Recommendations

• Update iPhone to the latest iOS version immediately.
• Avoid clicking unknown links received via social media or messaging apps.
• Use reputable wallet applications and verify their authenticity before installation.

Related Legal Developments

Apple is currently facing a lawsuit from three investors who claim to have lost approximately $1.8 million in Bitcoin after downloading a counterfeit wallet app from the App Store. The plaintiffs allege insufficient security oversight by Apple and are seeking compensation.