The new DarkSword iOS exploit kit targets iPhones running iOS versions 18.4 to 18.7 and has been used since November 2025 to steal extensive personal data, including cryptocurrency wallet information, through malware families like GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER. Discovered by Lookout and analyzed in cooperation with Google Threat Intelligence and iVerify, DarkSword exploits known vulnerabilities patched in the latest iOS releases, and its attacks begin via compromised websites injecting malicious iframes into the Safari browser to execute code that exfiltrates sensitive information. Users are advised to update to the latest iOS version and enable Lockdown Mode if at high risk.
New “Darksword” iOS Exploit Used in Infostealer Attack on iPhones
