Apple iOS Malware Targets Crypto Apps on Unpatched iPhones: Google

Google researchers have identified a sophisticated iOS exploit chain, named DarkSword, actively targeting iPhones running versions 18.4 through 18.7. This exploit chain is capable of delivering the Ghostblade malware, which specifically targets cryptocurrency exchange and wallet applications.

Exploit Mechanism and Malware Capabilities

The DarkSword exploit utilizes six vulnerabilities to deploy malware onto vulnerable devices once a user visits a malicious or compromised website. The Ghostblade malware, a JavaScript-based data stealer, actively searches for and targets major cryptocurrency exchange apps such as Coinbase, Binance, Kraken, Kucoin, OKX, and MEXC. It also targets popular crypto wallet applications including Ledger, Trezor, MetaMask, Exodus, Uniswap, Phantom, and Gnosis Safe.

Beyond targeting crypto apps, Ghostblade exfiltrates a wide range of sensitive data from infected devices. This includes SMS and iMessage messages, call history, contacts, Wi-Fi passwords, Safari cookies and browsing history, location data, health data, photos, saved passwords, and message history from Telegram and WhatsApp. The malware is designed for rapid data theft, collecting all available information before deleting its temporary files and terminating itself.

Observed Campaigns and Threat Actors

Multiple threat actors are employing the DarkSword exploit, ranging from commercial spyware vendors to state-backed groups. Campaigns have been observed in regions including Saudi Arabia, Turkey, Malaysia, and Ukraine. In Saudi Arabia, attacks have used a fake Snapchat application, while in Ukraine, compromised websites, including a government site, have been used to distribute the exploit.

Broader Context of Crypto-Targeting Malware

The discovery of DarkSword and Ghostblade follows a trend of increasing malware attacks targeting cryptocurrency users. Notable examples include the Inferno Drainer malware, which reportedly stole approximately $9 million from crypto users over a six-month period, and campaigns involving counterfeit Android smartphones pre-loaded with crypto-stealing malware.