DarkSword's Crypto Theft Flow: 25% of iPhones at Risk

The attack is financially driven from the start. The malware specifically targets a plethora of crypto wallet apps, including major exchanges and hardware wallet interfaces. This isn't random spying; it's a direct, automated hunt for digital assets and login credentials.

The execution is a classic hit-and-run. Once a vulnerable iPhone visits a malicious site, the exploit deploys its payload and begins exfiltration. The goal is to rapidly exfiltrate highly sensitive data-including credentials and cryptocurrency wallets-within minutes before the user even knows they've been compromised. The malware then erases its traces, leaving no easy forensic path for detection.

This full device takeover is enabled by a complex exploit chain. It leverages six different vulnerabilities in iOS and Safari to deploy its final-stage payloads. The entire compromise can be triggered by a single, unsuspecting visit to a malicious website, making it a powerful and stealthy tool for financial theft.

Attack Scale and Financial Exposure

The attack surface is massive, with nearly 25 percent of all iPhones still on some version of iOS 18. That figure represents potentially hundreds of millions of susceptible devices, creating a vast pool of targets for financially motivated attackers.

The exploit specifically targets a wide range of active iPhones, working against iOS versions 18.4 through 18.7. This window includes a significant portion of the installed base, making the vulnerability relevant for a large user group that may not have updated.

Multiple threat actors are deploying DarkSword, including both commercial spyware vendors and state-backed groups. This proliferation means the toolkit is being used in distinct, targeted campaigns across regions like Saudi Arabia, Turkey, Malaysia, and Ukraine, amplifying the global financial risk.

Catalysts and Financial Flow Implications

The primary catalyst for limiting financial damage is the speed at which users adopt the iOS 26.3 update that patches the six underlying vulnerabilities. The exploit is inactive on patched devices, making this adoption rate the critical variable that determines the attack window's duration and the total number of potential victims.

A major risk is the exploit's code being repurposed or sold on the secondary market. The evidence shows it has already been wielded by multiple commercial surveillance vendors and suspected state-sponsored actors. This proliferation means the toolkit could be adapted for broader, less targeted financial crime, accelerating its spread beyond the initial campaigns.

The real financial flow impact hinges entirely on the volume of successful attacks and the total value of crypto assets stolen before detection. The malware's "hit-and-run" technique aims to exfiltrate data within minutes, maximizing the theft window. The scale of the initial attack surface-potentially 25 percent of all iPhones-sets the upper bound for potential losses.