Google has announced that an advanced iOS security vulnerability chain, dubbed “DarkSword,” has been actively exploited since late 2025 and has led to the compromise of numerous iPhones.
Google Threat Intelligence Group (GTIG), the company’s security unit, stated that these attacks specifically targeted iOS versions 18.4 and 18.7.
According to GTIG’s analysis, DarkSword combines multiple zero-day vulnerabilities, allowing for complete compromise of devices. One of the most notable components, the malware called “GHOSTBLADE,” is said to be able to leak sensitive information, including cryptocurrency wallet data and user credentials. This poses a serious security risk, especially for crypto asset holders.
Google stated that the exploit chain has been active since at least November 2025 and is being used by both commercial surveillance software providers and those believed to be state-sponsored.
DarkSword reportedly exploited a total of six different vulnerabilities, and after a successful attack, three different malware families were activated: GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER. Google also reported that the UNC6353 group, previously known to have used the “Coruna” iOS vulnerability kit and believed to be linked to Russia, has integrated DarkSword into its new attack campaigns.
The company stated that all identified vulnerabilities were reported to Apple in late 2025 and fully patched with iOS 26.3. Google also announced that it has added the domain names used in the distribution of the attacks to its list of secure internet domains.
Google is warning users to update their devices to the latest iOS version, and for those unable to update, it recommends activating “Lockdown Mode” as an additional security measure. According to experts, outdated devices are increasingly at risk, particularly from cryptocurrency theft.
*This is not investment advice.