Apple has warned users of a new iOS exploitation tool called DarkSword that can extract cryptocurrency wallet files, messages, photos, and data from messaging apps including Telegram and WhatsApp. The malware, discovered by researchers at Google, iVerify, and Lookout, infects iPhones through malicious or compromised websites, following the earlier March disclosure of a similar exploit known as Coruna.
The company issued an urgent security advisory on March 19, stating that devices running current iOS updates are already protected against the attack. Apple released security patches on March 11 for iOS 15 and iOS 16, while users still on iOS 13 or 14 must upgrade to at least iOS 15 to mitigate the risk. The company also noted that its Lockdown Mode feature provides additional protection against these specific attacks, and Safari now blocks identified malicious domains by default.
Apple recommends all users immediately check for available iOS updates, with particular urgency for those on older operating system versions. The advisory underscores growing threats to cryptocurrency users, as wallet-targeting exploits represent a direct financial risk rather than typical privacy breaches. While the vulnerability does not affect all Apple devices simultaneously, the targeting of crypto-related files suggests sophisticated threat actors are specifically pursuing digital asset holders.