Google exposes DarkSword iOS exploit chain that siphons crypto wallet data from unpatched iPhones via Safari

Google’s Threat Intelligence Group (GTIG) has detailed a sophisticated iOS exploit chain dubbed DarkSword, used by multiple commercial surveillance vendors and suspected state-sponsored actors to fully compromise iPhones via Safari and steal sensitive data, including contents of cryptocurrency wallets. The attack begins when a target visits a malicious or compromised website in Safari, triggering a sequence of zero‑day exploits that achieve remote code execution, escape the browser sandbox, escalate to kernel privileges, and deploy in‑memory spyware implants.

✨ AI-generated background, compiled from web sources — not editorial content.

More coverage

• DarkSword iOS Exploit Chain - Threat Signal Report | FortiGuard Labs (fortiguard.fortinet.com)
• DarkSword: Researchers uncover another iOS exploit kit - Help Net ... (helpnetsecurity.com)
• Inside DarkSword: A New iOS Exploit Kit Delivered Via ... - iVerify (iverify.io)
• Proliferation of DarkSword iOS Exploit Chain Threat - Gurucul (gurucul.com)
• DarkSword: iPhone Exploit Kit Serves Spies & Thieves Alike (darkreading.com)

Explore the topic

• iOS
• Exploit
• Google
• Security