Risks for Crypto Enthusiasts Using Outdated iPhone Models
Crypto enthusiasts utilizing outdated iPhone models could be at risk of having their digital assets compromised. Cybersecurity researchers from Censys have revealed that a concerning hacking toolkit known as DarkSword continues to be employed to deploy malware that targets cryptocurrency wallets. This toolkit is notably associated with the Coruna malware, which aims to extract critical information from various crypto wallet applications.
Exploitation of Vulnerabilities
Despite its emergence months ago, the threat persists, as Censys experts have identified multiple servers that host the tools necessary for these malicious activities. The hacking exploits take advantage of vulnerabilities within Apple’s WebKit and JavaScriptCore, allowing the perpetrators to infiltrate susceptible iPhone devices and siphon off sensitive data.
Targeted Applications and Data
Once Coruna infects a device, it specifically focuses on crypto wallet applications such as Coinbase, MetaMask, Trust Wallet, Phantom, Exodus, Uniswap, Bitpie, imToken, and OKEx. Moreover, the malware’s capabilities extend beyond just wallet apps; it can also rummage through personal files, including photos and notes, in search of BIP39 recovery phrases—highly coveted codes that allow cybercriminals to regain access to digital wallets without even needing physical access to the compromised device.
Mitigation and Updates
Fortunately for users, Apple has addressed the flaws exploited by DarkSword; all identified vulnerabilities were patched in the latest iOS 26.3 update. However, individuals using older iPhone models with iOS 26.2 or earlier—particularly those with even older versions, such as iOS 18—remain susceptible if they haven’t updated their software. To mitigate these risks, crypto users are strongly advised to keep their devices updated with the latest security measures to protect against potential attacks.
