DarkSword exploit chain compromises unpatched iPhones, installs crypto-targeting malware; update to iOS 26.3

Google and mobile security researchers have identified an iOS exploit chain called DarkSword that has been actively used since late 2025 to compromise unpatched iPhones running older iOS 18 releases, prompting Apple to patch multiple linked vulnerabilities across separate updates ^{[1] [2]}.

Reported malware payloads associated with the chain—including spyware tracked as Ghostblade—specifically hunt for exchange and wallet applications (reports name targets such as Coinbase, Binance, Kraken, Ledger and MetaMask), exfiltrate sensitive and cryptocurrency-related data, and can be delivered via malicious websites without user interaction; some payloads reportedly erase themselves after extracting data ^{[3] [1] [4]}.

Researchers and vendors recommend updating to the patched iOS release (reported as iOS 26.3 in coverage) and using mitigations such as Lockdown Mode to reduce exposure, particularly for users who access exchanges or wallets on mobile devices ^{[3] [1]}.